CVE-2026-18995
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A flaw has been found in netease-youdao LobsterAI 2026.6.10, affecting the function parseMediaTokensFromText in the file src/renderer/services/artifactParser.ts in the MEDIA Path Handler component. This manipulation causes information disclosure. The attack is possible to be carried out remotely, and the exploit has been published.
Risk Assessment
An attacker can access sensitive information, potentially leading to data leakage or privacy breaches.
Recommendation
Update LobsterAI to the latest patched version. Restrict access to the parseMediaTokensFromText function and monitor logs for unusual requests.
Other vulnerabilities in LobsterAI
See all- CVE-2026-108156High
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory.
- CVE-2026-90818Medium
A vulnerability has been discovered in netease-youdao LobsterAI (versions 2026.6.15, 2026.8.28, 2026.9.3, 2026.9.4) in the function OpenClawConfigSync.buildBrowserConfig, leading to server-side request forgery. The attack can be launched remotely, and the exploit has been publicly released.
Original NVD description (English source)
A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS