iFlytek Astron Agent CVE-2026-116339

The target is the exec_ddl endpoint (core/memory/database/api/v1/exec_ddl.py) of the DDL Whitelist Handler in iFlytek astron-agent up to 1.1.2; exploitation requires that this memory-database DDL API is network-reachable and that its input filtering relies on the blacklist that CWE-184 identifies as incomplete, bypassed via SQL comment smuggling per the PoC reference. The vendor vector marks PR:N (no privileges), but the description does not confirm whether the endpoint is actually exposed without authentication, so authentication requirements are not confirmed from the available data. Limiting factors: impact is rated Low on confidentiality, integrity, and availability with no scope change, so consequences are partial rather than full compromise; realistic risk depends on whether the DDL API is exposed beyond a trusted internal boundary. No user interaction is required.

This is a medium-severity issue (vendor CVSS 4.0 base 5.5) that should be treated as a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no special attack requirements, but the impact is capped at Low across all three dimensions (VC:L/VI:L/VA:L) with no scope change, and the exploit-maturity metric is E:P (proof-of-concept). The input assigns a 'this_month' priority rather than act_now/emergency, which is consistent with the limited impact. No CISA KEV listing is present in the data and no EPSS score was provided, so there is no signal of active or widespread exploitation. A public PoC reference exists but is not verified as working exploit code, so POC availability must not be read as confirmed exploitation. CONFLICT/GAP to verify: the vector states PR:N (unauthenticated), yet the affected endpoint is a memory-database DDL execution API where production deployments commonly sit behind authentication - the description does not confirm whether the endpoint is exposed unauthenticated, so the no-privileges assumption should be validated against the actual deployment. Net: a real but contained weakness in a niche AI-agent project, worth patching on a normal cycle rather than an emergency.

A remote attacker with reach to the astron-agent memory-database exec_ddl API submits a DDL statement whose disallowed keywords are hidden using SQL comment smuggling, slipping past the incomplete blacklist in the DDL Whitelist Handler and getting an otherwise-forbidden DDL operation executed. A public PoC reference (v1_ddl_whitelist_comment_smuggling.py) exists but is not verified as working exploit code. Given the Low impact ratings, the realistic outcome is partial unauthorized read/modify of database schema or data rather than full compromise.