Netease-youdao vulnerabilities
We track 8 vulnerabilities in Netease-youdao products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.
Latest Netease-youdao vulnerabilities
- 7.1 High severity
LobsterAI: External Control of File Name or Path
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafte
- 7.5 High severity
QAnything: Missing Authentication for Critical Functionality
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identif
- 8.1 High severity
netease-youdao/qanything: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoi
- 7.5 High severity
netease-youdao/qanything: Origin Validation Error
A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS poli
- 7.5 High severity
netease-youdao/qanything: Improper Limitation of a Pathname to a Restricted Directory
A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private fi
- 7.5 High severity
netease-youdao/qanything: Uncontrolled Resource Consumption
A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit t
- 9.8 Critical severity
netease-youdao/qanything: Inconsistent Interpretation of HTTP Requests
HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, s
- 9.8 Critical severity
netease-youdao/qanything: Improper Neutralization of Special Elements used in an SQL Command
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_file