제출 #862623: netease-youdao LobsterAI 2026.6.10 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

# Technical Details
An arbitrary local file read vulnerability exists in the artifact loading pipeline of LobsterAI. The `src/renderer/services/artifactParser.ts` module parses `MEDIA:` file references from assistant or tool output messages and stores the resulting path in `artifact.filePath` without any trust or workspace validation. The `src/renderer/components/cowork/CoworkSessionDetail.tsx` component then auto-loads these file-backed artifacts on session open, treating absolute paths as trusted and forwarding them into `window.electron.dialog.readFileAsDataUrl(absPath)`. The Electron main process in `src/main/main.ts` then services the IPC call by resolving and reading the path from disk with no workspace containment or allowlist root check.

# Vulnerable Code
File: src/renderer/services/artifactParser.ts (lines 272-320)
Method: parseMediaTokensFromText()
Why: Accepts untrusted `MEDIA:` and `file://` paths and stores them in `artifact.filePath` without workspace validation.

File: src/renderer/components/cowork/CoworkSessionDetail.tsx (lines 1786-1831)
Method: CoworkSessionDetail auto-loader
Why: Treats absolute parsed paths as trusted and forwards them to `readFileAsDataUrl` automatically on session open.

File: src/main/main.ts (lines 8186-8210)
Method: dialog:readFileAsDataUrl IPC handler
Why: Resolves and reads the supplied path with `fs.promises.readFile()` without restricting to session workspace or approved allowlist root.

# Reproduction
1. Build LobsterAI Electron application from source.
2. Seed a malicious assistant message containing `MEDIA: /absolute/path/to/sensitive/file` into the session SQLite database.
3. Open the Cowork session in the desktop application.
4. Verify via strace that `statx` and `openat` syscalls are issued against the canary file outside the workspace.
5. Confirm the control case (relative path only) produces no outside canary trace hit.

# Impact
- Arbitrary local file read / information disclosure in a desktop AI assistant.
- Any local file readable by the user account can be accessed, including source code, logs, user documents, and secrets.
- Data pulled into the Artifact pipeline may be exposed to later preview, copy, share, or model-ingestion flows.

• 원천: ⚠️ https://github.com/netease-youdao/LobsterAI/issues/2176
• 사용자: ChenMarry (UID 99089)
• 제출: 2026. 06. 18. AM 09:35 (2 개월 ago)
• 모더레이션: 2026. 08. 05. PM 09:31 (2 months later)
• 상태: 수락
• VulDB 항목: 386378 [netease-youdao LobsterAI 2026.6.10 MEDIA Path artifactParser.ts parseMediaTokensFromText 정보 공개]
• 포인트들: 20