LobsterAI EUVD-2026-95904

Requires the victim to install an attacker-crafted skill package whose _meta.json sets openclawSourceDir to a target such as the home directory, and to subsequently uninstall that skill through the skills:delete IPC handler, which trusts the value during cleanup. The security scanner does not inspect _meta.json, so the crafted package passes vetting. Limiting factors that reduce real-world risk: it is not remotely exploitable (AV:L), it requires user interaction for both install and uninstall (UI:P), only applies to versions 2026.5.27 through 2026.9.23, and deletion is bounded to user-writable directories.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 base score is 6.9 (medium) with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H: exploitation is local, low-complexity, needs no attacker privileges, but hinges on passive user interaction (the victim must install and later uninstall a crafted skill). Impact is destructive - high integrity and availability loss from recursive deletion of user-writable directories including the home directory - with no confidentiality impact (VC:N). No EPSS score was provided, so statistical exploitation likelihood cannot be assessed. It is NOT in CISA KEV and there is no evidence of active exploitation. No weaponized public exploit was identified; the only code artifact is the vendor's regression test shipped with the patch, which demonstrates the fix, not an attack tool. SSVC inputs (exploitation status, automatable, technical impact) were not supplied. One conflict to flag explicitly: the input tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N - this is an arbitrary-deletion (integrity/availability) flaw, not an information-disclosure issue. Net: treat as a social-engineering / malicious-package supply-chain risk affecting a niche product, patch on a normal priority cadence.

An attacker publishes a seemingly benign skill (e.g. a weather helper) to a skill store with a poisoned _meta.json whose openclawSourceDir points at the victim's home directory. Because the security scanner never inspects _meta.json, the package passes vetting; when the victim later uninstalls the skill via the skills:delete IPC handler, LobsterAI trusts that path and recursively deletes the targeted directory. No public exploit code exists, but the local, low-complexity vector means a successful social-engineering lure reliably leads to destructive deletion once uninstall is triggered.