Lobsterai
Monthly
Server-side request forgery in netease-youdao LobsterAI affects the `buildBrowserConfig` function within the Browser Network Configuration component, enabling remote attackers to manipulate the application into making forged outbound network requests to attacker-specified targets. Versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4 are confirmed affected per EUVD enumeration and NVD CPE wildcard coverage. A public proof-of-concept exploit is hosted on GitHub Gist; no vendor patch has been released, and the originating GitHub issue was closed automatically due to inactivity, suggesting no upstream remediation is forthcoming.
Information disclosure in netease-youdao LobsterAI 2026.6.10 exposes sensitive data through manipulation of the MEDIA Path Handler component. The vulnerable function parseMediaTokensFromText in src/renderer/services/artifactParser.ts can be triggered remotely when a user interacts with attacker-controlled content, leaking confidential information such as local file system paths or internal metadata. A publicly available exploit exists via GitHub issue #2176, and the vendor has not responded to coordinated disclosure, leaving no patch available at time of analysis.
Server-side request forgery in netease-youdao LobsterAI affects the `buildBrowserConfig` function within the Browser Network Configuration component, enabling remote attackers to manipulate the application into making forged outbound network requests to attacker-specified targets. Versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4 are confirmed affected per EUVD enumeration and NVD CPE wildcard coverage. A public proof-of-concept exploit is hosted on GitHub Gist; no vendor patch has been released, and the originating GitHub issue was closed automatically due to inactivity, suggesting no upstream remediation is forthcoming.
Information disclosure in netease-youdao LobsterAI 2026.6.10 exposes sensitive data through manipulation of the MEDIA Path Handler component. The vulnerable function parseMediaTokensFromText in src/renderer/services/artifactParser.ts can be triggered remotely when a user interacts with attacker-controlled content, leaking confidential information such as local file system paths or internal metadata. A publicly available exploit exists via GitHub issue #2176, and the vendor has not responded to coordinated disclosure, leaving no patch available at time of analysis.