EUVD-2026-45244
GHSA-g248-jp4x-cq55
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network XSS with low-privilege auth and required victim interaction; scope changes as payload executes in victim browser, yielding C:L/I:L with no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text_to_image/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the component T2I Feature. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated remote attackers to inject and execute malicious scripts via the Text-to-Image (T2I) feature, specifically through the Star.text_to_image and NetworkRenderStrategy.render functions in astrbot/core/star/base.py. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the public POC materially lowers the exploitation bar.
Technical ContextAI
AstrBot is a community-developed AI chatbot framework (CPE: cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting), meaning user-supplied input passed to the T2I feature is rendered into a web or HTML context without sufficient sanitization or output encoding. The affected code path runs through Star.text_to_image and NetworkRenderStrategy.render in astrbot/core/star/base.py; the NetworkRenderStrategy name implies the rendering is performed via a network call (e.g., a remote rendering service), and the XSS surfaces when the rendered output is returned and displayed in a browser without escaping attacker-controlled content.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure. The most effective immediate mitigation is to disable the T2I (Text-to-Image) feature entirely if it is not operationally required, which eliminates the vulnerable code path at the cost of losing that functionality. Access to the AstrBot interface should be restricted to trusted, authenticated users only, reducing the pool of potential attackers; this does not eliminate the vulnerability but raises the exploitation bar. Deploying strict Content Security Policy (CSP) headers at the web layer (e.g., default-src 'self') can limit the browser-level impact of any successful XSS injection, though CSP alone is not a fix. Monitor the VulDB entry at https://vuldb.com/vuln/379788 and the AstrBotDevs project repository for patch releases. The public PoC at https://gist.github.com/YLChen-007/2abcecece4369c46cc8405e597c0528b should be used to validate whether mitigations are effective in your environment.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today