CVE-2026-90818mediumCWE-918

CVE-2026-90818: fallo de gravedad media en netease-youdao LobsterAI

netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LobsterAI

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.5%
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
netease-youdao · LobsterAI
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — netease-youdao LobsterAI

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-18995MEDIUMnetease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosureEPSS 0.5%CVE-2026-108156MEDIUMLobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.jsonEPSS 0.2%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%