CVE-2026-108156 Details

A vulnerability exists in LobsterAI versions 2026.5.27 through 2026.9.23, allowing for arbitrary directory deletion. This issue arises in the 'skills:delete' IPC handler, which improperly trusts the 'openclawSourceDir' value from a skill's '_meta.json' file during the uninstallation process. As a result, attackers can craft skills that, when uninstalled, recursively delete any user-writable directories, including the home directory. This vulnerability is not detected by the application's security scanner, which fails to inspect the '_meta.json' file.

Users can manually edit the '_meta.json' file of any skills installed from untrusted sources to remove the 'openclawSourceDir' field before uninstalling them. After making this adjustment, the skill can be uninstalled without risking unintended directory deletion.