HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108156 — LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path ...

·Source: NIST NVD

Updated:

Executive Summary

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scann

Analysis

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json. CVSS Score: 7.1. Published: 2026-10-09T17:16:46.540.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108156
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer
MEDIUMVulnerability

Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]

BleepingComputer
MEDIUMVulnerability

Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

SANS ISC