{"id":"CVE-2025-62505","revision":null,"records":[{"revision":"27dbda48a3114210a8f39bb0e08b5420","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-62505","aliases":[],"title":"SSRF in lobehub/lobe-chat with native web fetch module","description":"LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist.","state":0,"publishedAt":"2025-10-17T18:18:53.739+00:00","modifiedAt":"2025-10-17T18:32:20.732+00:00","affected":[{"ecosystem":"Vendor product","name":"lobe-chat","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"lobehub\",\n \"product\": \"lobe-chat\",\n \"versions\": [\n {\n \"version\": \"< 1.136.2\",\n \"status\": \"affected\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","score":3,"severity":"LOW"}],"references":["https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9","https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-62505","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-62505","identifiers":["CVE-2025-62505"]},"retained":false,"historicalAffected":[]},{"revision":"9df95cec8f1c420d9c8987a0040275b2","observedAt":"2026-11-09T04:05:50.727+00:00","statement":{"source":"euvd","id":"EUVD-2025-34905","aliases":["CVE-2025-62505","GHSA-fgx4-p8xf-qhp9"],"title":"LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array to…","description":"LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","score":3,"severity":null}],"references":["https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9","https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34905","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 17, 2025, 6:18:53 PM","dateUpdated":"Oct 17, 2025, 6:32:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-34905","identifiers":["EUVD-2025-34905","CVE-2025-62505","GHSA-fgx4-p8xf-qhp9"]},"retained":false,"historicalAffected":[]},{"revision":"7e2a6ec82b4447d88b63c87a67088c4c","observedAt":"2026-10-25T03:17:29.935+00:00","statement":{"source":"nvd","id":"CVE-2025-62505","aliases":[],"title":"LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array to…","description":"LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist.","state":0,"publishedAt":"2025-10-17T19:15:38.167+00:00","modifiedAt":"2026-10-08T22:10:00.563+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","score":3,"severity":"LOW"}],"references":["https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c","https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62505","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2025-10-17T19:15:38.167","lastModified":"2026-10-08T22:10:00.563"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-62505","identifiers":["CVE-2025-62505"]},"retained":false,"historicalAffected":[]},{"revision":"f2fee85c78944eaab02a91637ffc781d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-fgx4-p8xf-qhp9","aliases":["CVE-2025-62505"],"title":"Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module","description":"### Vulnerability Description\n---\n\nVulnerability Overview\n \n- When\u00A0the client sends an arbitrary\u00A0URL\u00A0array and\u00A0impl:\u00A0[\"naive\"]\u00A0to the tRPC endpoint\u00A0tools.search.crawlPages, the server\u00A0issues outbound HTTP requests\u00A0directly to those URLs. There is no\u00A0defensive logic that restricts or validates requests to internal networks (127.0.0.1, localhost, private ranges) or\u00A0metadata endpoints (169.254.169.254).\n\n- Flow: client input (urls,\u00A0impls) → service\u00A0invocation in the tRPC router\u00A0→ the service passes the URLs\u00A0to\u00A0Crawler.crawl\u00A0→ the\u00A0Crawler\u00A0prioritizes the user-specified\u00A0impls\u00A0(naive)\u00A0→ the\u00A0naive\u00A0implementation performs a server-side\u00A0fetch(url)\u00A0as-is\u00A0(SSRF) → the\u00A0server collects responses from\u00A0internal resources.\n\n- In the\u00A0dev environment, authentication can\u00A0be bypassed using the\u00A0lobe-auth-dev-backend-api: 1\u00A0header (production\u00A0requires a valid\u00A0token). In the PoC, this was used to successfully retrieve\u00A0the internal API at\u00A0localhost:8889\u00A0from the server side.\n\nVulnerable\u00A0Code\n \n\nhttps://github.com/lobehub/lobe-chat/blob/d942a635b36a231156c60d824afa573af8032572/packages/web-crawler/src/crawImpl/naive.ts#L39-L45\n\n\n### PoC\n---\n\nPoC Description\n\n- In\u00A0dev\u00A0mode, we made a single tRPC call using the auth-bypass header\u00A0lobe-auth-dev-backend-api: 1. Since tRPC requires the\u00A0body to\u00A0be\u00A0in the form\u00A0{\"json\": {\u00A0... }}, we\u00A0placed\u00A0urls\u00A0and\u00A0impls: [\"naive\"]\u00A0inside\u00A0json\u00A0to\u00A0induce the\u00A0server to\u00A0request the\u00A0internal URL\u00A0(http://localhost:8889/internel-api).\n\n- The\u00A0response follows\u00A0tRPC’s wrapping\u00A0structure, so\u00A0the actual body\u00A0of\u00A0the internal\u00A0API is\u00A0included\u00A0as a\u00A0string\u00A0(JSON string) at\u00A0result.data.json.results[0].data.content. We\u00A0post-process\u00A0it\u00A0with\u00A0jq\u00A0for\u00A0readability.\n\ncurl Example \n\n```bash\ncurl -sS -X POST 'http://localhost:3010/trpc/tools/search.crawlPages' \\\n -H 'Content-Type: application/json' \\\n -H 'lobe-auth-dev-backend-api: 1' \\\n --data '{\"json\":{\"urls\":[\"http://localhost:8889/internal-api\"],\"impls\":[\"naive\"]}}' | jq -r '.result.data.json.results[0].data.content' | jq .\n```\n\"poc\"\n\n\n### Impact\n---\n\n- Since the server performs outbound requests to internal networks, localhost, and metadata endpoints, an attacker can abuse the server’s\u00A0network position to access internal resources (internal APIs, management ports, cloud metadata, etc.).\n\n- As a result, this can lead\u00A0to exposure of internal system information, leakage of authentication tokens/secret keys (e.g., IMDSv1/v2), misuse of internal admin interfaces, and\u00A0provide a foothold for further lateral movement.\n\n- By leveraging user-supplied\u00A0impls\u00A0to force the unfiltered\u00A0naive\u00A0implementation, SSRF defenses—such as blocking private/metadata IPs, DNS re-validation/re-resolution, and\u00A0redirect restrictions—can be bypassed.","state":0,"publishedAt":"2025-10-17T17:46:09+00:00","modifiedAt":"2025-10-17T21:32:47+00:00","affected":[{"ecosystem":"npm","name":"@lobehub/chat","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.136.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9","https://nvd.nist.gov/vuln/detail/CVE-2025-62505","https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c","https://github.com/lobehub/lobe-chat","https://github.com/lobehub/lobe-chat/blob/d942a635b36a231156c60d824afa573af8032572/packages/web-crawler/src/crawImpl/naive.ts#L39-L45"],"sourceUrl":"https://github.com/advisories/GHSA-fgx4-p8xf-qhp9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fgx4-p8xf-qhp9","identifiers":["GHSA-fgx4-p8xf-qhp9","CVE-2025-62505"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9790817+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9790869+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-a0960c299e2dafbb2e8450fb21550287bc0c3b97298514596ae2b1697fb7bc3b","complete":true,"records":422070,"lastAttemptAt":"2026-11-10T15:21:29.3452518+00:00","lastSuccessAt":"2026-11-10T15:21:29.2151501+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.3452518+00:00","snapshotPublishedAt":"2026-11-10T14:23:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T15:25:10.8168504+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9798315+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9798317+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-738cd6499f9748c9890b05108858c833","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T15:25:10.154636+00:00","lastSuccessAt":"2026-11-10T15:25:10.15+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T15:25:10.15+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13142,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T15:24:08.6813477+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.6813477+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T15:21:29.495451+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.495451+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T15:24:08.7869291+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.7869291+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-db2f6ba81f9ad8cbb9260cd64e408b90232da96003174aeed666a4ce1c7aabd5","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T15:24:08.5102562+00:00","lastSuccessAt":"2026-11-10T15:24:05.6823404+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.5102562+00:00","snapshotPublishedAt":"2026-11-10T14:33:27+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}