CVE-2026-18995: LobsterAI Information Disclosure Flaw

CVE-2026-18995 Overview

CVE-2026-18995 is an information disclosure vulnerability in netease-youdao LobsterAI 2026.6.10. The flaw resides in the parseMediaTokensFromText function within src/renderer/services/artifactParser.ts, part of the MEDIA Path Handler component. Manipulation of media tokens processed by this function leads to unauthorized information exposure [CWE-200]. The vulnerability can be exploited remotely, though successful exploitation requires user interaction. A public exploit has been released. According to the National Vulnerability Database (NVD) record, the project was notified through an issue report but has not responded at the time of publication.

Critical Impact
Remote attackers can trigger information disclosure by inducing a user to process crafted media tokens in LobsterAI, exposing data handled by the artifact parser.

Affected Products

netease-youdao LobsterAI 2026.6.10
Component: MEDIA Path Handler (src/renderer/services/artifactParser.ts)
Function: parseMediaTokensFromText

Discovery Timeline

2026-08-06 - CVE-2026-18995 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18995

Vulnerability Analysis

The vulnerability affects the parseMediaTokensFromText function in the LobsterAI renderer. This function parses media tokens embedded in text content and resolves them to file paths for rendering. Insufficient validation or sanitization of the parsed path allows the function to reference resources outside the intended scope. The resulting behavior exposes information the user did not intend to share with the calling context.

The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Because the parser executes in the renderer process, the exposed content can flow back through the application's chat or artifact pipeline. A working exploit has been published in the GitHub Issue #2176 tracker, increasing the likelihood of opportunistic abuse.

Root Cause

The root cause is improper handling of media path tokens inside parseMediaTokensFromText. The function accepts token strings from untrusted text input and constructs file references without adequate validation. As a result, crafted tokens redirect the parser to read data outside the expected media directory.

Attack Vector

The attack is remote and requires user interaction. An attacker delivers text containing malicious media tokens through any input surface that reaches the artifact parser, such as chat messages, shared artifacts, or imported documents. When the victim processes the content in LobsterAI, the parser resolves the crafted tokens and returns the referenced information to the rendering context. See the VulDB entry for CVE-2026-18995 and the LobsterAI GitHub repository for technical context.

Detection Methods for CVE-2026-18995

Indicators of Compromise

Media tokens in chat or artifact payloads that reference absolute paths, parent-directory traversal sequences, or files outside the application's media directory.
Unexpected file reads originating from the LobsterAI renderer process targeting user profile directories, configuration files, or system paths.
Outbound traffic from LobsterAI containing content that matches files on the local filesystem which were not user-selected.

Detection Strategies

Monitor endpoint file-access telemetry for the LobsterAI process reading paths outside its installation and expected media directories.
Inspect artifact and chat logs for token strings that deviate from the application's documented media reference format.
Correlate LobsterAI process activity with outbound network sessions to identify potential exfiltration of resolved file content.

Monitoring Recommendations

Enable process and file telemetry on endpoints running LobsterAI and forward events to a centralized analytics platform for retention and query.
Establish a baseline of normal file paths accessed by the LobsterAI renderer to make anomalous reads easier to identify.
Track the upstream GitHub Issue #2176 for a maintainer response and future patch commits.

How to Mitigate CVE-2026-18995

Immediate Actions Required

Restrict LobsterAI 2026.6.10 to trusted internal use only until a fix is released, and avoid processing artifacts or messages from untrusted senders.
Inventory endpoints running LobsterAI and apply application allow-listing or execution controls where the application is not required.
Educate users to avoid opening shared artifacts or pasted content from unknown sources into LobsterAI.

Patch Information

No vendor patch is available at the time of publication. The project has not responded to the disclosure filed as GitHub Issue #2176. Track the LobsterAI GitHub repository for release notes and commits touching src/renderer/services/artifactParser.ts.

Workarounds

Remove or disable LobsterAI on systems handling sensitive data until a fixed version is published.
Run LobsterAI under a least-privilege user account without access to sensitive directories, limiting what the parser can read.
Apply host-based access controls that deny the LobsterAI process read access to directories outside its installation and designated media folders.

bash

# Example: restrict the LobsterAI user's read access on Linux
# Move media assets into a dedicated directory owned by the LobsterAI user
sudo mkdir -p /opt/lobsterai/media
sudo chown lobsterai:lobsterai /opt/lobsterai/media
sudo chmod 750 /opt/lobsterai/media

# Deny read access to sensitive directories for the lobsterai user
sudo setfacl -m u:lobsterai:--- /home
sudo setfacl -m u:lobsterai:--- /etc