Astrbot
Astrbot: vulnerabilidades y CVE
Astrbot tiene 24 vulnerabilidades publicadas, 23 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE24
Últimos 12 meses23
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-17530 | Baja (2.1) | 0.37% | — | 27 jul 2026 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component… |
| CVE-2026-17529 | Baja (2.1) | 0.37% | — | 27 jul 2026 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect… |
| CVE-2026-16077 | Baja (1.9) | 0.21% | — | 18 jul 2026 | A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a… |
| CVE-2026-16076 | Baja (2.1) | 0.51% | — | 18 jul 2026 | A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the… |
| CVE-2026-16075 | Baja (2.1) | 0.37% | — | 18 jul 2026 | A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing… |
| CVE-2026-16074 | Baja (2.1) | 0.35% | — | 17 jul 2026 | A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The… |
| CVE-2026-16073 | Baja (2) | 0.33% | — | 17 jul 2026 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text_to_image/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the… |
| CVE-2026-15501 | Baja (2.1) | 0.35% | — | 12 jul 2026 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboard/routes/tools.py of the component MCP… |
| CVE-2026-15500 | Baja (2.1) | 0.37% | — | 12 jul 2026 | A weakness has been identified in AstrBotDevs AstrBot up to 4.25.2. Affected by this vulnerability is the function get_online_plugins of the file astrbot/dashboard/routes/plugin.py of the component market_list Endpoint.… |
| CVE-2026-15499 | Baja (2.1) | 0.35% | — | 12 jul 2026 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a… |
| CVE-2026-10213 | Baja (2.1) | 0.37% | — | 1 jun 2026 | A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of the component API Endpoint. Performing a manipulation of the argument Name… |
| CVE-2026-10212 | Baja (2.1) | 0.21% | — | 1 jun 2026 | A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manipulation of the argument session_id leads to authorization… |
| CVE-2026-10211 | Baja (2.1) | 0.20% | — | 1 jun 2026 | A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect… |
| CVE-2026-10210 | Baja (2.1) | 0.23% | — | 1 jun 2026 | A vulnerability was found in AstrBotDevs AstrBot 4.23.6. Affected by this vulnerability is the function _sanitize_prompt_description of the file astrbot/core/skills/skill_manager.py. The manipulation results in… |
| CVE-2026-8754 | Baja (2.1) | 0.43% | — | 17 may 2026 | A vulnerability was detected in AstrBotDevs AstrBot up to 4.23.5. Impacted is the function post_file of the file astrbot/dashboard/routes/chat.py of the component File Upload Handler. The manipulation of the argument… |
| CVE-2025-55449 | Alta (7.3) | 0.28% | — | 8 may 2026 | AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT. |
| CVE-2026-7579 | Media (5.5) | 0.50% | — | 1 may 2026 | A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads… |
| CVE-2026-6984 | Baja (2) | 0.41% | — | 25 abr 2026 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in… |
| CVE-2026-6119 | Baja (2.1) | 0.35% | — | 12 abr 2026 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the function post_data.get of the component API Endpoint. Such manipulation leads to server-side request forgery. The attack… |
| CVE-2026-6118 | Baja (2.1) | 3.5% | — | 12 abr 2026 | A vulnerability was determined in AstrBotDevs AstrBot up to 4.22.1. Impacted is the function add_mcp_server of the file astrbot/dashboard/routes/tools.py of the component MCP Endpoint. This manipulation of the argument… |
| CVE-2026-6117 | Baja (2.1) | 0.38% | — | 12 abr 2026 | A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. This issue affects the function install_plugin_upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The… |
| CVE-2025-57697 | Media (6.5) | 0.32% | — | 7 nov 2025 | AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defined in entities.py opens the image specified by the user in the request body and… |
| CVE-2025-57698 | Alta (7.5) | 0.78% | — | 7 nov 2025 | AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user,… |
| CVE-2025-48957 | Alta (7.5) | 0.74% | — | 2 jun 2025 | AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers,… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.