Read the docs

netease-youdao

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

netease-youdao records in CISA KEV

No netease-youdao vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Qanything 5 records HIGH

Records

12 records

TI-2024-06574 CVE-2024-7099 · GHSA-vqmq-g46j-863w

SQL Injection in netease-youdao/qanything

Priority HIGH 82

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00626 Published 2024-10-13 Fixed in 1.4.2 CWE-89
TI-2024-09510 CVE-2024-10264 · GHSA-jx9r-x782-9r4m

HTTP Request Smuggling in netease-youdao/qanything

Priority HIGH 81

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00955 Published 2025-03-20 No fix listed CWE-444
TI-2024-11923 CVE-2024-12866 · GHSA-6ch3-c5vc-j2r6

Local File Inclusion in netease-youdao/qanything

Priority HIGH 74

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01518 Published 2025-03-20 No fix listed CWE-22
TI-2024-07438 CVE-2024-8024 · GHSA-h35f-g2pq-8xq7

CORS Misconfiguration in netease-youdao/qanything

Priority HIGH 72

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00317 Published 2025-03-20 No fix listed CWE-346
TI-2026-70099 CVE-2026-108156

Arbitrary directory deletion in LobsterAI via skill uninstall

Priority MEDIUM 64

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall.

CVSS 4.0MEDIUM 6.9 Local No auth User interaction EPSS 0.00189 Published 2026-10-09 No fix listed CWE-73
TI-2026-61721 CVE-2026-90818 · GHSA-f8g8-8f29-j2hw

Server-side request forgery in netease-youdao LobsterAI

Priority MEDIUM 57

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00538 Published 2026-09-14 No fix listed CWE-918
TI-2026-58783 CVE-2026-85671 · GHSA-mq4x-r3rg-g5rq

QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

Priority MEDIUM 45

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or docume…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00643 Published 2026-09-04 No fix listed CWE-306
TI-2026-76166 CVE-2026-112014 · GHSA-rpw3-ccp2-4v8w

Hardcoded password in LobsterAI exposes provider API keys in exports

Priority LOW 29

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00126 Published 2026-10-18 Fixed in 2026.10.16 CWE-321
Open these records in search →