The vulnerability resides in the parseMediaTokensFromText function of LobsterAI's MEDIA Path Handler, allowing an attacker to trigger the function remotely and cause disclosure of sensitive data. The exact type of data exposed has not been specified, but the function parses media tokens from text, implying that internal token or path information could be leaked. Because the flaw can be exploited from a remote context, any authenticated or unauthenticated user with network access to the application potentially could gain unintended information.

Netease-Youdao LobsterAI version 2026.6.10 is affected. The issue appears in the src/renderer/services/artifactParser.ts file within the MEDIA component of LobsterAI. No other versions or components are currently listed as vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, but the published exploit suggests the vulnerability is reachable and may already be in use. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, likely through network requests that invoke the vulnerable parseMediaTokensFromText routine. Without a vendor patch, the risk remains until a fix is released or mitigated.