Threats tagged 'ghsa-pwqg-g4m5-54gf'

LobsterAI versions 2026.5.27 through 2026.9.23 have a vulnerability where the uninstallation process can be manipulated via a crafted skill's _meta.json file. This flaw allows an attacker to cause recursive deletion of arbitrary user-writable directories by controlling the openclawSourceDir value. The vulnerability arises because the security scanner does not inspect the _meta.json file during skill installation.