Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lobehub/lobe-chat
canary @ 14b711e
133
Fixes
0
CVEs
CRITICAL
Peak severity
26.3%
Coverage
Highlights
Auth Bypass: 36 prior fixes. Scrutinize any change in this area.
apps/server/src/routers/lambda/agent.ts: most-fixed (5 issues). Treat as high-risk during review.
115 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass / Authorization Bypass: Recurring pattern of missing workspace membership, ownership, or RBAC checks on tRPC and OpenAPI procedures, allowing cross-workspace data access or unauthorized mutations.
Privilege Escalation: Confused-deputy attacks where external bot senders could access owner's device tools via explicit activator activation, bypassing canUseDevice gate.
SSRF: Multiple server-side fetch paths accepted user-controlled URLs without IP filtering, enabling requests to internal/private hosts. Centralized ssrf-safe-fetch guard added but sibling paths may still miss it.