CVE-2026-108156

Name of the Vulnerable Software and Affected Versions LobsterAI versions 2026.5.27 through 2026.9.23

Description An external control of file path issue exists in the skills:delete IPC handler. The system trusts the openclawSourceDir value defined in a skill's meta.json file during the uninstallation process. Because the security scanner does not inspect the meta.json file, an attacker who convinces a user to install a specially crafted skill can trigger the recursive deletion of arbitrary user-writable directories, such as the home directory, upon uninstallation.

Recommendations Update LobsterAI to a version later than 2026.9.23.