EUVD-2026-33531
GHSA-6vvm-92fq-599w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function _sanitize_prompt_description of the file astrbot/core/skills/skill_manager.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the _sanitize_prompt_description function in astrbot/core/skills/skill_manager.py, bypassing sanitization and achieving partial impact on confidentiality, integrity, and availability. A publicly available exploit (POC) exists on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch has been released. No public exploit identified as confirmed actively exploited (CISA KEV), though the public POC and low-privilege entry point lower the barrier for exploitation.
Technical ContextAI
AstrBot is an AI chatbot/assistant framework maintained by AstrBotDevs. The vulnerability resides in the _sanitize_prompt_description function within astrbot/core/skills/skill_manager.py, which is responsible for processing and sanitizing user-supplied prompt descriptions in AstrBot's skill management subsystem. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) indicates that the function fails to adequately neutralize special characters or sequences before they are passed to a downstream processor - such as a template engine, command interpreter, or AI prompt pipeline - allowing injected content to alter downstream behavior. The CPE cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* uses a wildcard version field, indicating that NVD/VulDB has not bounded the affected version range beyond the confirmed 4.23.6 reference.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version number is available from any source. As a compensating control, administrators should restrict access to AstrBot's skill management interface to trusted, minimally privileged users only, reducing the pool of potential attackers who meet the PR:L requirement. Operators should consider disabling or sandboxing the skill registration/description submission feature entirely if it is not operationally required, as this directly removes the attack surface in _sanitize_prompt_description. Network-level controls such as placing AstrBot behind an authenticated reverse proxy or VPN will limit remote exploitability (AV:N). Monitor the VulDB entry at https://vuldb.com/vuln/367489 and the AstrBotDevs repository for any upstream patch. The public POC at https://gist.github.com/YLChen-007/f9d45a9c68b15a382677a820ee881bbb should be reviewed to understand the specific injection vector and inform signature-based detection in WAF or IDS rules.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today