All 5 CVE vulnerabilities found in astron-agent, with AI-generated Chinese analysis, references, and POCs.
Vendor: iflytek
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-108864 | iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint CWE-639 | 4.2 | Medium | 2026-10-11 |
| CVE-2026-108263 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE CWE-95 | 9.9 | Critical | 2026-10-09 |
| CVE-2026-95930 | iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery CWE-918 | 6.3 | Medium | 2026-09-23 |
| CVE-2026-95929 | iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection CWE-89 | 6.3 | Medium | 2026-09-23 |
| CVE-2026-82475 | iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check CWE-862 | 8.1 | High | 2026-08-29 |
All 5 known CVE vulnerabilities affecting astron-agent with full Chinese analysis, references, and POCs where available.