CVE-2026-58578

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.15

Description An authenticated attacker can cause a regular expression denial of service (ReDoS) by providing a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. This occurs when a malicious basePath value containing unescaped regex metacharacters is injected into a dynamically constructed regular expression within the findSkillMd() function. Because this is executed synchronously against archive entries, it blocks the Node.js event loop, denying service to all concurrent users for tens of seconds per request. Catastrophic backtracking is a condition where a regular expression engine takes an exponential amount of time to determine that a string does not match a pattern.

Recommendations Update LobeChat to version 2.2.10-canary.15 or later.