CVE-2026-108156: skill _meta.json path abuse deletes

CISO Take

LobsterAI versions 2026.5.27 through 2026.9.23 trust an attacker-controlled openclawSourceDir value in a skill's _meta.json during uninstall, so removing a crafted skill recursively deletes any user-writable directory, including the whole home directory. The built-in security scanner never inspects _meta.json, so a malicious skill passes the vetting users would otherwise rely on. Exposure is limited by the need to get a user to install the skill and by local-only access (CVSS 7.1). There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, and the downstream footprint is unknown. Upgrade to a build containing upstream commit 82fdfe10 (see issue #2793), treat third-party skills as untrusted code, and keep tested backups of endpoints where the agent runs.

Sources:NVDVulnCheckGitHub (netease-youdao/LobsterAI)ATLAS

What is the risk?

High severity (CVSS 3.1: 7.1, AV:L/AC:L/PR:N/UI:R). Exploitation is trivial once a user installs and later uninstalls a crafted skill, and it needs no privileges. Impact is high integrity and availability loss: irreversible deletion of user data, source code, credentials stores, and AI workspace content. There is no confidentiality impact. Likelihood is moderated by the user-interaction requirement, the lack of known exploitation, and an unknown user base, but skill marketplaces and community sharing make social-engineering delivery plausible. No exploit code or scanner template is public as of publication.

How does the attack unfold?

Initial Access

Attacker distributes a crafted skill whose _meta.json sets openclawSourceDir to a sensitive directory such as the home folder.

AML.T0104

User Execution

Victim installs the skill, and the security scanner passes it because it never inspects _meta.json.

AML.T0011.002

Exploitation

On uninstall, the skills:delete IPC handler trusts the poisoned path and starts a recursive delete.

Impact

The home directory and other user-writable data are irreversibly deleted.

AML.T0101

Initial Access

Attacker distributes a crafted skill whose _meta.json sets openclawSourceDir to a sensitive directory such as the home folder.

AML.T0104

User Execution

Victim installs the skill, and the security scanner passes it because it never inspects _meta.json.

AML.T0011.002

Exploitation

On uninstall, the skills:delete IPC handler trusts the poisoned path and starts a recursive delete.

Impact

The home directory and other user-writable data are irreversibly deleted.

AML.T0101

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CNone

IHigh

AHigh

What should I do?

1 step

1) Upgrade LobsterAI to a release that includes commit 82fdfe10 (fix for issue #2793); verify against the vendor repository and the VulnCheck advisory. 2) Until patched, do not uninstall skills from untrusted or unreviewed sources, and avoid installing third-party skills. 3) Manually inspect _meta.json of installed skills for openclawSourceDir values pointing outside the skills directory, such as ~, /, or other absolute paths. 4) Maintain tested backups (Time Machine, versioned Git remotes, cloud sync with history) on endpoints running agent apps. 5) Detection: use EDR rules to alert on the LobsterAI process performing mass recursive deletions outside its application data directory, and on spikes in file-delete events from the app's main process. 6) Run the app under a restricted user profile or sandbox where feasible.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainSocial EngineeringAgentPluginAML.T0011.002- Poisoned AI Agent Tool AML.T0101- Data Destruction via AI Agent Tool Invocation AML.T0104- Publish Poisoned AI Agent Tool

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to unknown risks and third-party component risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-108156?

LobsterAI versions 2026.5.27 through 2026.9.23 trust an attacker-controlled openclawSourceDir value in a skill's _meta.json during uninstall, so removing a crafted skill recursively deletes any user-writable directory, including the whole home directory. The built-in security scanner never inspects _meta.json, so a malicious skill passes the vetting users would otherwise rely on. Exposure is limited by the need to get a user to install the skill and by local-only access (CVSS 7.1). There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, and the downstream footprint is unknown. Upgrade to a build containing upstream commit 82fdfe10 (see issue #2793), treat third-party skills as untrusted code, and keep tested backups of endpoints where the agent runs.

Is CVE-2026-108156 actively exploited?

No confirmed active exploitation of CVE-2026-108156 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108156?

1) Upgrade LobsterAI to a release that includes commit 82fdfe10 (fix for issue #2793); verify against the vendor repository and the VulnCheck advisory. 2) Until patched, do not uninstall skills from untrusted or unreviewed sources, and avoid installing third-party skills. 3) Manually inspect _meta.json of installed skills for openclawSourceDir values pointing outside the skills directory, such as ~, /, or other absolute paths. 4) Maintain tested backups (Time Machine, versioned Git remotes, cloud sync with history) on endpoints running agent apps. 5) Detection: use EDR rules to alert on the LobsterAI process performing mass recursive deletions outside its application data directory, and on spikes in file-delete events from the app's main process. 6) Run the app under a restricted user profile or sandbox where feasible.

What systems are affected by CVE-2026-108156?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, desktop AI agent applications, AI skill/plugin marketplaces, developer workstations.

What is the CVSS score for CVE-2026-108156?

CVE-2026-108156 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdesktop AI agent applicationsAI skill/plugin marketplacesdeveloper workstations

MITRE ATLAS Techniques

AML.T0011.002Poisoned AI Agent Tool

AML.T0101Data Destruction via AI Agent Tool Invocation

AML.T0104Publish Poisoned AI Agent Tool

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.

Exploitation Scenario

An attacker publishes a helpful-looking skill, for example a productivity or code-helper skill, to a community repository or shares it directly. The skill's _meta.json sets openclawSourceDir to the victim's home directory. The built-in security scanner reviews only the skill's code and prompts, not _meta.json, so the skill is approved. The victim installs and uses it, and later uninstalls it. The skills:delete IPC handler follows the poisoned path and recursively removes the home directory, destroying projects, keys, notes, and local AI data. The attack is delayed and looks like an ordinary uninstall, making attribution difficult.

Weaknesses (CWE)

CWE-73External Control of File Name or PathPrimary CWE-73External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.