Astrbotdevs
Monthly
Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restrictions and execute unauthorized function tools. A public exploit exists, and a patch is available from the vendor. No active exploitation has been reported via CISA KEV, but the public exploit increases risk for deployments using persona tool controls.
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released.
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function `OpenApiRoute.get_chat_sessions` in `astrbot/dashboard/routes/open_api.py` fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier.
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make the server issue arbitrary HTTP requests by injecting a malicious URL into the download_url, download_urls, or proxy arguments of the plugin update handler. The affected endpoint resides in astrbot/dashboard/routes/plugin.py within the update_plugin and update_all_plugins functions. A public proof-of-concept exploit exists on GitHub, and the vendor did not respond to the coordinated disclosure, leaving users without an official patch.
Cross-site scripting in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated remote attackers to inject and execute malicious scripts via the Text-to-Image (T2I) feature, specifically through the `Star.text_to_image` and `NetworkRenderStrategy.render` functions in `astrbot/core/star/base.py`. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the public POC materially lowers the exploitation bar.
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests via a manipulated `mcp_server_config.url` parameter. All AstrBot versions through 4.25.2 are affected via the `ToolsRoute.test_mcp_connection` function in `astrbot/dashboard/routes/tools.py`. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no vendor-issued patch at time of analysis.
Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to issue arbitrary HTTP requests by supplying a malicious value for the `custom_registry` parameter at the `market_list` plugin marketplace endpoint. The affected function is `get_online_plugins` in `astrbot/dashboard/routes/plugin.py`. A public proof-of-concept exploit is available on GitHub, though this vulnerability is not listed in the CISA KEV catalog. The CVSS 4.0 score of 2.1 reflects the authentication barrier and constrained impact, making this a lower-priority but tactically exploitable issue for attackers with dashboard access.
Improper authorization in AstrBot's Scheduled Task Handler allows a remote low-privileged user to bypass authorization controls by manipulating the payload["note"] argument in FutureTaskTool.call (astrbot/core/tools/cron_tools.py), affecting all versions up to and including 4.25.2. A publicly available proof-of-concept exploit (GitHub gist) demonstrates exploitation. No patch has been released and the vendor did not respond to disclosure; EPSS and CVSS 4.0 score this at 5.3, indicating moderate-to-low real-world severity, but the active POC elevates practical risk for deployed instances. Not currently listed in CISA KEV.
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skills/delete API endpoint to escape the intended directory boundary, enabling unauthorized deletion or corruption of arbitrary files on the host system. The CVSS vector (C:N/I:L/A:L) confirms no confidentiality exposure but meaningful integrity and availability impact. A public proof-of-concept exploit is available on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released at time of analysis.
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate the session_id argument within the astr_main_agent function to access or control sessions belonging to other users. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to verify that the requesting user owns the supplied session_id. A publicly available exploit exists via GitHub gist, no vendor patch has been released, and the vendor did not respond to disclosure - elevating practical risk above what the CVSS 6.3 Medium score alone implies.
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions via the `_normalize_rw_path` function in `astrbot/core/tools/computer_tools/fs.py`, resulting in unauthorized read, write, or access to files outside the intended scope. The vulnerability stems from improper path normalization logic that fails to enforce access controls correctly, enabling authenticated users to escape sandboxed file boundaries. A public proof-of-concept exploit exists on GitHub, and the vendor was unresponsive to coordinated disclosure, leaving no official patch available at time of analysis.
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_description` function in `astrbot/core/skills/skill_manager.py`, bypassing sanitization and achieving partial impact on confidentiality, integrity, and availability. A publicly available exploit (POC) exists on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch has been released. No public exploit identified as confirmed actively exploited (CISA KEV), though the public POC and low-privilege entry point lower the barrier for exploitation.
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended directories via manipulated filenames. Affected versions through 4.23.5 fail to sanitize user-supplied filenames in the post_file function, enabling directory traversal sequences (../, ..\ ) to bypass access controls. Publicly available exploit code exists (GitHub Gist by YLChen-007). Vendor-released patch in version 4.23.6 implements filename sanitization using PurePosixPath normalization and path validation to prevent traversal. CVE assigned CVSS 6.3 (Medium) with low-privilege remote exploitation confirmed. No CISA KEV listing indicates exploitation remains targeted rather than widespread.
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authentication and gain partial system access. The vulnerability resides in astrbot/dashboard/routes/auth.py, allowing complete authentication bypass without network complexity or user interaction. A public exploit exists on GitHub, and the vendor has not responded to responsible disclosure attempts, leaving users exposed to credential-based attacks with moderate impact across confidentiality, integrity, and availability (CVSS 7.3). EPSS data not available; KEV status negative indicates no confirmed widespread exploitation despite public POC.
Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.
Server-side request forgery (SSRF) in AstrBot API endpoint post_data.get allows authenticated remote attackers to perform arbitrary HTTP requests from the server, potentially exposing internal services or enabling data exfiltration. AstrBot versions up to 4.22.1 are affected. Publicly available exploit code exists, though vendor response remains pending despite early notification.
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to execute arbitrary system commands via the command parameter. Versions up to 4.22.1 are affected. The vulnerability is publicly disclosed with exploit code available on GitHub, and the vendor has not released a patch despite early notification.
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.
Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restrictions and execute unauthorized function tools. A public exploit exists, and a patch is available from the vendor. No active exploitation has been reported via CISA KEV, but the public exploit increases risk for deployments using persona tool controls.
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released.
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function `OpenApiRoute.get_chat_sessions` in `astrbot/dashboard/routes/open_api.py` fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier.
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make the server issue arbitrary HTTP requests by injecting a malicious URL into the download_url, download_urls, or proxy arguments of the plugin update handler. The affected endpoint resides in astrbot/dashboard/routes/plugin.py within the update_plugin and update_all_plugins functions. A public proof-of-concept exploit exists on GitHub, and the vendor did not respond to the coordinated disclosure, leaving users without an official patch.
Cross-site scripting in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated remote attackers to inject and execute malicious scripts via the Text-to-Image (T2I) feature, specifically through the `Star.text_to_image` and `NetworkRenderStrategy.render` functions in `astrbot/core/star/base.py`. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the public POC materially lowers the exploitation bar.
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests via a manipulated `mcp_server_config.url` parameter. All AstrBot versions through 4.25.2 are affected via the `ToolsRoute.test_mcp_connection` function in `astrbot/dashboard/routes/tools.py`. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no vendor-issued patch at time of analysis.
Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to issue arbitrary HTTP requests by supplying a malicious value for the `custom_registry` parameter at the `market_list` plugin marketplace endpoint. The affected function is `get_online_plugins` in `astrbot/dashboard/routes/plugin.py`. A public proof-of-concept exploit is available on GitHub, though this vulnerability is not listed in the CISA KEV catalog. The CVSS 4.0 score of 2.1 reflects the authentication barrier and constrained impact, making this a lower-priority but tactically exploitable issue for attackers with dashboard access.
Improper authorization in AstrBot's Scheduled Task Handler allows a remote low-privileged user to bypass authorization controls by manipulating the payload["note"] argument in FutureTaskTool.call (astrbot/core/tools/cron_tools.py), affecting all versions up to and including 4.25.2. A publicly available proof-of-concept exploit (GitHub gist) demonstrates exploitation. No patch has been released and the vendor did not respond to disclosure; EPSS and CVSS 4.0 score this at 5.3, indicating moderate-to-low real-world severity, but the active POC elevates practical risk for deployed instances. Not currently listed in CISA KEV.
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skills/delete API endpoint to escape the intended directory boundary, enabling unauthorized deletion or corruption of arbitrary files on the host system. The CVSS vector (C:N/I:L/A:L) confirms no confidentiality exposure but meaningful integrity and availability impact. A public proof-of-concept exploit is available on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released at time of analysis.
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate the session_id argument within the astr_main_agent function to access or control sessions belonging to other users. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the server fails to verify that the requesting user owns the supplied session_id. A publicly available exploit exists via GitHub gist, no vendor patch has been released, and the vendor did not respond to disclosure - elevating practical risk above what the CVSS 6.3 Medium score alone implies.
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions via the `_normalize_rw_path` function in `astrbot/core/tools/computer_tools/fs.py`, resulting in unauthorized read, write, or access to files outside the intended scope. The vulnerability stems from improper path normalization logic that fails to enforce access controls correctly, enabling authenticated users to escape sandboxed file boundaries. A public proof-of-concept exploit exists on GitHub, and the vendor was unresponsive to coordinated disclosure, leaving no official patch available at time of analysis.
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_description` function in `astrbot/core/skills/skill_manager.py`, bypassing sanitization and achieving partial impact on confidentiality, integrity, and availability. A publicly available exploit (POC) exists on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch has been released. No public exploit identified as confirmed actively exploited (CISA KEV), though the public POC and low-privilege entry point lower the barrier for exploitation.
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended directories via manipulated filenames. Affected versions through 4.23.5 fail to sanitize user-supplied filenames in the post_file function, enabling directory traversal sequences (../, ..\ ) to bypass access controls. Publicly available exploit code exists (GitHub Gist by YLChen-007). Vendor-released patch in version 4.23.6 implements filename sanitization using PurePosixPath normalization and path validation to prevent traversal. CVE assigned CVSS 6.3 (Medium) with low-privilege remote exploitation confirmed. No CISA KEV listing indicates exploitation remains targeted rather than widespread.
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authentication and gain partial system access. The vulnerability resides in astrbot/dashboard/routes/auth.py, allowing complete authentication bypass without network complexity or user interaction. A public exploit exists on GitHub, and the vendor has not responded to responsible disclosure attempts, leaving users exposed to credential-based attacks with moderate impact across confidentiality, integrity, and availability (CVSS 7.3). EPSS data not available; KEV status negative indicates no confirmed widespread exploitation despite public POC.
Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.
Server-side request forgery (SSRF) in AstrBot API endpoint post_data.get allows authenticated remote attackers to perform arbitrary HTTP requests from the server, potentially exposing internal services or enabling data exfiltration. AstrBot versions up to 4.22.1 are affected. Publicly available exploit code exists, though vendor response remains pending despite early notification.
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to execute arbitrary system commands via the command parameter. Versions up to 4.22.1 are affected. The vulnerability is publicly disclosed with exploit code available on GitHub, and the vendor has not released a patch despite early notification.
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.