CVE-2026-6984

MEDIUM

AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-359527 | AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine
https://vuldb.com/vuln/359527
Signature, Permissions Required signature permissions-required
VDB-359527 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359527/cti
Third Party Advisory third-party-advisory
Submit #796164 | AstrBotDevs AstrBot 4.22.1 Server-Side Template Injection
https://vuldb.com/submit/796164

Scores

CVSS v3 4.7
EPSS 0.0030
EPSS Percentile 21.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1336 CWE-791
Status published
Products (3)
AstrBotDevs/AstrBot 4.22.0
AstrBotDevs/AstrBot 4.22.1
pypi/AstrBot 0PyPI
Published Apr 25, 2026
Tracked Since Apr 25, 2026