Is there a public PoC exploit available for CVE-2026-6984?

Yes, a public proof-of-concept exploit is available for CVE-2026-6984. Prioritise patching immediately. EPSS: 0.0%.

AstrBot CVE-2026-6984

Q: What is the CVSS score of CVE-2026-6984?

CVE-2026-6984 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25660 LOW

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-04-25 VulDB

Information Disclosure Ssti Astrbot Astrbotdevs

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 25, 2026 - 16:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 16:00 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 15:45 euvd

EUVD-2026-25660

Analysis Generated

Apr 25, 2026 - 15:45 vuln.today

CVE Published

Apr 25, 2026 - 15:30 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.

Technical ContextAI

The vulnerability exists in the create_template function within astrbot/dashboard/routes/t2i.py, which improperly neutralizes special elements used in template engine processing (CWE-1336: Template Injection). This is a server-side template injection (SSTI) flaw where user-supplied input is processed by a backend template engine without proper sanitization, allowing attackers to inject template directives. The affected CPE (cpe:2.3:a:astrbotdevs:astrbot) indicates all AstrBot versions up to and including 4.22.1 are in scope. The Dashboard API component handles template creation operations, which if exposed to untrusted input, can lead to arbitrary template expression evaluation.

RemediationAI

Immediate upgrade to a patched version is recommended, though no vendor-released fix version is currently available per the unresponsive disclosure status. Until a patch is released, implement network segmentation to restrict Dashboard API access to trusted administrative networks only, disable the create_template endpoint if not actively used, enforce strict input validation on all template parameters by implementing a template sandbox or safe whitelist of allowed template directives, and monitor template creation logs for suspicious patterns. Additionally, enforce multi-factor authentication for dashboard administrative accounts and implement rate limiting on the create_template endpoint to slow exploitation attempts. Organizations should monitor the AstrBot GitHub repository (https://github.com/AstrBotDevs/AstrBot/) and VulDB advisory (https://vuldb.com/vuln/359527) for vendor patch announcements.