AstrBot Remote T2I Rendering Path XSS via Unescaped Text Injection

Vulnerability Overview Title: AstrBot Remote T2I Template Allows Script Injection via Unescaped Text in Bundled HTML Template Description: AstrBot's remote Text-to-Image (T2I) rendering path places attacker-controlled reply text into a bundled HTML template using inside a hidden . Since the value is not HTML-escaped, an attacker can inject , breaking out of the text container to cause script injection during HTML parsing. This results in script injection within the context of the remotely accessible T2I renderer. This is a genuine vulnerability in a remote T2I rendering chain. However, existing evidence supports renderer-context script injection/XSS rather than stronger server-side RCE claims involving . Impact Scope Affected Products: - Ecosystem: GitHub - Package Name: AstrBotDev/AstrBot - Affected Versions: <= 4.25.2 - Fixed Versions: None Severity: Medium Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Weakness: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Remediation Remediation Status: No specific remediation mentioned, but upgrading to the fixed version is recommended. POC Code Reproduction Steps 1. Download the minimal template breakout POC from . 2. Run from the AstrBot repository: 3. Observe that the rendered HTML contains a breakout tag instead of keeping the payload as inert textarea text. 4. For end-to-end reachability verification, download the integrated POC from . 5. Run the integrated POC in an environment capable of launching AstrBot and the script simulator: 6. Optionally run the comparison/control script: . 7. Check the generated log output to confirm that the malicious payload reaches the remote T2I request unescaped. Evidence Logs Impact This is a template/script injection vulnerability located in AstrBot's remote Text-to-Image rendering path. Who is Affected: AstrBot deployments that enable T2I and use the remote rendering strategy. Deployments that place attacker-controlled text into HTML via bundled or custom templates without proper encoding. What an Attacker Can Do: Inject script HTML into the remote T2I renderer context. Tamper with or forge the rendered output image. Potentially escalate impact depending on the renderer's capabilities and isolation boundaries. Unverified Evidence: Server-side command execution on the AstrBot server. Local file read/write on the AstrBot host. SSRF originating from the AstrBot server. Dashboard session compromise. Guaranteed capability in Node/Electron environments.

Goal Reached Thanks to every supporter — we hit 100%!

AstrBot Remote T2I Rendering Path XSS via Unescaped Text Injection