Arbitrary Directory Deletion in LobsterAI Product by Netease Youdao

CVE-2026-108156

What is CVE-2026-108156?

The LobsterAI product versions 2026.5.27 through 2026.9.23 contain a vulnerability in the skills:delete IPC handler. This vulnerability arises from the unverified trust placed in the openclawSourceDir value originating from a skill's _meta.json during the uninstallation process. Attackers can exploit this weakness by persuading a user to install a malicious skill which, upon uninstallation, may lead to the recursive deletion of arbitrary user-writable directories, including sensitive locations such as the user's home directory. This occurs because the security scanner fails to inspect the _meta.json file, leaving systems open to potential arbitrary directory deletion.

References