Skip to content
OpenAdvisories

Package · PyPI

astrbot

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.3
    CVE-2025-55449 Public exploit

    AstrBot is vulnerable to RCE with hard-coded JWT signing keys

    AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

    astrbot PyPI
  • High 7.3
    CVE-2026-7579

    AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials

    A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possibl…

    AstrBotDevs AstrBot astrbot PyPI
  • High 7.5
    CVE-2025-57698

    AstrBot contains a directory traversal vulnerability

    AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign…

    astrbot PyPI
  • High 7.5
    CVE-2025-48957

    AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

    AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. T…

    AstrBotDevs AstrBot astrbot PyPI