Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AstrBot — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in AstrBot, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for AstrBot, an open-source chatbot framework. It collects disclosed security flaws, ranging from authentication bypasses to command injection and deserialization issues, covering advisories published between 2023 and 2024. Readers can track AstrBot's advisory history, understand common weakness classes affecting bot frameworks, and examine the product's cumulative vulnerability exposure. No marketing language is used, and no specific CVE identifiers are listed. The content serves as a neutral reference for security teams evaluating the risk profile of deployments using AstrBot.

Vendor: AstrBotDevs

CVE ID Title CVSS Severity Published
CVE-2026-17530 AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization CWE-863 6.3 Medium 2026-07-27
CVE-2026-17529 AstrBotDevs AstrBot astr_main_agent.py authorization CWE-863 6.3 Medium 2026-07-27
CVE-2026-16077 AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following CWE-59 5.3 Medium 2026-07-18
CVE-2026-16076 AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing CWE-290 6.3 Medium 2026-07-18
CVE-2026-16075 AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization CWE-639 4.3 Medium 2026-07-18
CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery CWE-918 6.3 Medium 2026-07-17
CVE-2026-16073 AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting CWE-79 3.5 Low 2026-07-17
CVE-2026-15501 AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery CWE-918 6.3 Medium 2026-07-12
CVE-2026-15500 AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery CWE-918 6.3 Medium 2026-07-12
CVE-2026-15499 AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization CWE-285 6.3 Medium 2026-07-12
CVE-2026-10213 AstrBotDevs AstrBot API Endpoint delete path traversal CWE-22 5.4 Medium 2026-06-01
CVE-2026-10212 AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization CWE-639 6.3 Medium 2026-06-01
CVE-2026-10211 AstrBotDevs AstrBot fs.py _normalize_rw_path authorization CWE-863 6.3 Medium 2026-06-01
CVE-2026-10210 AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection CWE-74 6.3 Medium 2026-06-01
CVE-2026-8754 AstrBotDevs AstrBot File Upload chat.py post_file path traversal CWE-22 6.3 Medium 2026-05-17
CVE-2026-7579 AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials CWE-798 7.3 High 2026-05-01
CVE-2026-6984 AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine CWE-1336 4.7 Medium 2026-04-25
CVE-2026-6119 AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery CWE-918 6.3 Medium 2026-04-12
CVE-2026-6118 AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection CWE-77 6.3 Medium 2026-04-12
CVE-2026-6117 AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox CWE-265 6.3 Medium 2026-04-12
CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file CWE-23 7.5 High 2025-06-02

All 21 known CVE vulnerabilities affecting AstrBot with full Chinese analysis, references, and POCs where available.