CVE-2026-108156

Katalog CVE

CVSS 7.1 · High EPSS 0,12%

Kerentanan External Control of File Name or Path. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

14 Oktober 2026

Status NVD

Deferred

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/netease-youdao/LobsterAI
• https://github.com/netease-youdao/LobsterAI/blob/791a352dee3b3d8c6f64edcaf229ce474a68f6c5/src/main/ipcHandlers...
• https://github.com/netease-youdao/LobsterAI/commit/82fdfe10d1b85d0ff734aa720e18c866b4be2406
• https://github.com/netease-youdao/LobsterAI/issues/2793
• https://www.vulncheck.com/advisories/lobsterai-2026.5.27-through-2026.9.23-arbitrary-directory-deletion-via-sk...