The CVSS 7.6 rating for CVE-2026-72594 likely understates the real severity. The score depends entirely on how lobe-chat handles SVG avatars — whether it sanitizes on upload, serves raw SVG with image/svg+xml content-type, or wraps avatars in <img> tags. This architectural detail is not disclosed in the CVE, and it's the difference between a real stored XSS and a vulnerability that may not exist in practice.
If lobe-chat serves raw SVG inline, browsers will execute embedded JavaScript. This is a true stored XSS with a broad blast radius: any user, admin, or automated system viewing the attacker's profile triggers the payload. The 'low-privilege authenticated user' framing is also concerning — it suggests the avatar renders in contexts where higher-privilege users encounter it, creating a privilege escalation vector that the CVSS doesn't fully model.
But the deeper problem is that avatars don't live in one place. They flow through webhooks, email notifications, API responses, and admin dashboards. Wrapping avatars in <img> tags — the simplest remediation — only addresses browser rendering. Every automated system consuming avatar data still receives raw SVG unless that data is sanitized at the storage layer, not the render layer. If a webhook processes the avatar URL as XML, the blast radius extends to systems the CVSS never modeled.
There's also a temporal dimension the CVE doesn't capture. Historical SVG files uploaded before any remediation remain in storage, callable by old avatar URLs, waiting for a parser differential that bypasses whatever sanitization was added. And historically, SVG sanitization patches for this exact vulnerability class have a documented pattern of being incomplete, bypassed, then later removed as 'unused code' in subsequent release cycles — the fix has a half-life, but the vulnerability surface persists.
Investigate: does the avatar render in admin panels, message previews, or notification systems where content rendering is less sandboxed? Check whether avatars flow through any server-side XML processing pipelines. Verify that any sanitization covers namespace tricks and parser differentials, not just <script> tag stripping.