Vulnerability · Published Aug 6, 2026 · Assigned by VulDB

CVE-2026-18995netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

Medium 4.3

In plain English

A medium-severity information exposure in LobsterAI from netease-youdao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
netease-youdao	LobsterAI	2026.6.10

Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-386378 | netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure vdb-entry, technical-description
VDB-386378 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-18995 | CVE Analysis and Report third-party-advisory
Submit #862623 | netease-youdao LobsterAI 2026.6.10 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) third-party-advisory
https://github.com/netease-youdao/LobsterAI/issues/2176 exploit, issue-tracking
https://github.com/netease-youdao/LobsterAI/ product