CVE-2026-108263— Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
Quick assessment
Affected
iflytek astron-agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Astron Agent 是一个用于构建和运行 AI 智能体（AI agents）的代理工作流平台。在版本 1.1.2 之前，当未显式更改 CODE_EXEC_TYPE 环境变量时，通过 和 路径执行的默认工作流代码节点会使用 中的 LocalExecutor。LocalExecutor 在未遵循文档所述沙箱限制的情况下，向动态代码执行提供了完整的 Python 内置函数支持。因此，拥有认证的低权限租户可以以 root 用户身份在核心工作流容器中执行任意代码，并利用共享服务和数据库凭据绕过应用层级的租户隔离检查，从
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1552 · Unsecured Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108263
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Astron Agent: Unsandboxed code-node leads to cross-tenant RCE
Source: CVE Program / CVE List V5
Vulnerability Description
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| iflytek | astron-agent | < 1.1.2 | - |
|
II. Public POCs for CVE-2026-108263
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108263
请登录查看更多情报信息。
Other References for CVE-2026-108263 (6)
-
https://github.com/iflytek/astron-agent/pull/1650 x_refsource_MISC
-
https://github.com/iflytek/astron-agent/pull/1651 x_refsource_MISC
-
https://github.com/iflytek/astron-agent/releases/tag/v1.1.2 x_refsource_MISC
-
https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5 x_refsource_CONFIRM
Same Patch Batch · iflytek · 2026-10-09 · 3 CVEs total
| CVE-2026-108160 | 7.5 HIGH | AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed |
| CVE-2026-108159 | 7.5 HIGH | AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge |
IV. Related Vulnerabilities
Same vendor: iflytek
-
CVE-2026-108160
AstronRPA through 1.1.6 Unsigned Update Installation via Pla -
CVE-2026-108159
AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and -
CVE-2026-95930
iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.c -
CVE-2026-95929
iFlytek astron-agent getBotList API endpoint ChatBotMarketMa -
CVE-2026-82475
iFlytek astron-agent through 1.1.1 Workflow Hijacking via Mi
Same weakness: CWE-95
-
CVE-2026-85486
Brocade ASCG <3.5.0 任意代码执行漏洞 -
CVE-2026-105315
django-haystack more_like_this Template Tag elasticsearch_ba -
CVE-2026-69662
Toptech TMS7 and TopHAT Eval Injection -
CVE-2024-42002
Unsafe use of eval() method in ros2 topic hz tool -
CVE-2026-101861
Langflow Code Execution via eval() in Component Input Schema
V. Comments for CVE-2026-108263
No comments yet