CVE-2026-108156 in LobsterAI
Summary
by MITRE • 10/09/2026
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in LobsterAI versions 2026.5.27 through 2026.9.23 represents a critical external control of file path issue within the application's inter-process communication (IPC) mechanism, specifically targeting the skills deletion handler. This flaw stems from an insecure trust relationship where the system relies on unvalidated input derived from a skill's metadata configuration file, known as _meta.json. During the uninstallation process for any installed skill, the software retrieves the openclawSourceDir value directly from this JSON structure without performing adequate sanitization or validation checks. This design decision creates a significant security gap because it assumes that all content within the metadata files is benign and correctly formatted by legitimate developers, ignoring the possibility of malicious modification during installation or prior to execution.
From a technical perspective, the core issue lies in the lack of path canonicalization and boundary checking when processing directory paths for deletion operations. When an attacker successfully convinces a user to install a crafted skill package containing a manipulated _meta.json file, they can inject arbitrary absolute paths into the openclawSourceDir field. Because the security scanner associated with this process fails to inspect or validate these metadata files prior to their use in system commands, the application proceeds to execute recursive deletion operations on whatever directory path is specified by the attacker. This behavior allows for a classic path traversal scenario where relative components such as dot-dot-slash sequences can be used to escape intended directories and target sensitive locations elsewhere in the file system hierarchy.
The operational impact of this vulnerability is severe, potentially leading to catastrophic data loss or complete system compromise depending on user privileges. Since the deletion operation is recursive, an attacker who controls the input path can cause the application to delete not just the skill's own directory but any arbitrary user-writable directories accessible by the running process. In many typical deployment scenarios where users run applications with standard desktop permissions, this could result in the destruction of the entire home directory, including personal documents, configuration files, and cached data. This constitutes a denial-of-service condition that is difficult to recover from without backups, effectively rendering the user's environment unusable until restoration procedures are completed.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves trusting external input for file path construction without sufficient restrictions on where those paths can point. Furthermore, the exploitation method falls under MITRE ATT&CK technique T1485: Data Destruction, which describes actions taken by adversaries with the intent to disrupt availability or destroy data stored in systems and networks. The specific mechanism of using a trusted configuration file as an attack vector also reflects aspects of CWE-94: Improper Control of Generation of Code (Code Injection) if one considers the metadata processing logic itself being manipulated, though it is more accurately classified under input validation failures leading to destructive side effects.
To mitigate this vulnerability, immediate updates to LobsterAI beyond version 2026.9.23 are required as they presumably address these path handling flaws. In the interim, users should exercise extreme caution when installing skills or extensions from untrusted sources, verifying their integrity through checksums if available. Developers and security teams implementing similar IPC handlers must enforce strict allow-listing of expected directory structures rather than relying on user-provided paths for destructive operations like deletion. Implementing robust input validation that canonicalizes all file paths and ensures they remain within a predefined safe base directory is essential to prevent such traversal attacks. Additionally, applying the principle of least privilege by running application components with minimal necessary permissions can limit the scope of damage even if an attacker successfully exploits this flaw.