CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

EUVD-2026-95904

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2026-108156

LobsterAI versions 2026.5.27 through 2026.9.23 are vulnerable to an external control of file path vulnerability (CWE-73) within the skills:delete IPC handler. The application fails to validate the openclawSourceDir value provided in a skill's _meta.json file during the uninstallation process. An ...