Threats affecting pkg:github/netease-youdao/LobsterAI

LobsterAI versions 2026.5.27 through 2026.9.23 have a vulnerability where the uninstallation process can be manipulated via a crafted skill's _meta.json file. This flaw allows an attacker to cause recursive deletion of arbitrary user-writable directories by controlling the openclawSourceDir value. The vulnerability arises because the security scanner does not inspect the _meta.json file during skill installation.

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

CVE-2026-18995 is an information disclosure vulnerability in netease-youdao LobsterAI version 2026.6.10. The flaw exists in the parseMediaTokensFromText function within the MEDIA Path Handler component. This vulnerability can be exploited remotely and has a published exploit available. The vendor has been informed but has not yet responded or issued a fix.