CVE-2026-18995: fallo de gravedad media en netease-youdao LobsterAI
netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.5%
A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
netease-youdao · LobsterAIPoCs públicas encontradas — 1
cve_referencegithub.com/netease-youdao/LobsterAI/issues/2176no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — netease-youdao LobsterAI
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-90818MEDIUMnetease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgeryEPSS 0.5%CVE-2026-108156MEDIUMLobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.jsonEPSS 0.2%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%