CVE-2026-6118

A security flaw in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in the function _build_handoff_toolset of the Subagent component. The attack can be launched remotely. Exploit is publicly available.

A vulnerability in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in an unknown function of astrbot/core/astr_main_agent.py via manipulation of the req.func_tool argument. The attack can be launched remotely. Exploit is publicly available.

A vulnerability was found in AstrBot up to version 4.25.5 in the _normalize_rw_path function of the fs.py file in the Filesystem Computer-Use Tool component. The flaw allows link following with local access. The exploit is public and the vendor did not respond.

A vulnerability in AstrBot up to version 4.25.5 affects the OpenApiRoute.chat_send function in open_api.py. Manipulating the Username argument in the API allows authentication bypass via spoofing. The attack can be launched remotely and exploit details are publicly available.

A flaw in AstrBot up to version 4.25.5 affects the OpenApiRoute.get_chat_sessions function in astrbot/dashboard/routes/open_api.py. Manipulation of the Username argument in the session-listing endpoint leads to authorization bypass. The attack is remotely exploitable and a public exploit exists.

A server-side request forgery (SSRF) vulnerability was found in AstrBot up to version 4.25.2 in the plugin update handler component. An attacker can remotely manipulate the download_url, download_urls, or proxy arguments to send requests to internal network resources. The exploit is publicly available.

The Star.text_to_image/NetworkRenderStrategy.render function in the file astrbot/core/star/base.py in AstrBot up to version 4.25.2 is vulnerable to XSS. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.

A server-side request forgery (SSRF) vulnerability has been detected in AstrBot up to version 4.25.2 in the MCP Test Endpoint component. The issue affects the ToolsRoute.test_mcp_connection function in the file astrbot/dashboard/routes/tools.py, where an attacker can manipulate the mcp_server_config.url argument. The vulnerability has been publicly disclosed and can be exploited remotely.

A server-side request forgery (SSRF) vulnerability has been identified in AstrBot up to version 4.25.2. The issue exists in the get_online_plugins function within astrbot/dashboard/routes/plugin.py, where manipulation of the custom_registry argument in the market_list endpoint allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.

A security flaw in the Scheduled Task Handler component of AstrBot up to version 4.25.2 affects the FutureTaskTool.call function in astrbot/core/tools/cron_tools.py. Manipulating the payload["note"] argument causes improper authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.