CVE-2026-108156mediumCWE-73

CVE-2026-108156: falha de média gravidade em netease-youdao LobsterAI

LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LobsterAI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
netease-youdao · LobsterAI
CVEs relacionadas — netease-youdao LobsterAI

No mesmo produto, das mais perigosas para as menos.

CVE-2026-90818MEDIUMnetease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgeryEPSS 0.5%CVE-2026-18995MEDIUMnetease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosureEPSS 0.5%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%