CVE-2026-108156: Netease-Youdao Lobsterai

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.

Affected products

• Netease-Youdao Lobsterai: from 2026.5.27, up to and including 2026.9.23

Published 2026-10-09. Last modified 2026-10-09.