Skip to content
OpenAdvisories

Vendor

iflytek

14 known vulnerabilities.

Products

astron-agent 7 astron-rpa 5 skillhub 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.3
    CVE-2026-116339

    iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

    A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be i…

    iflytek astron-agent
  • High 8.1
    CVE-2026-110211

    SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

    iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous se…

    iflytek skillhub
  • High 8.8
    CVE-2026-108550

    SkillHub before 0.2.22 Account Takeover via Account Merge Flow

    SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoin…

    iflytek skillhub
  • High 7.3
    CVE-2026-108548

    AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

    AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/r…

    iflytek astron-rpa
  • High 7.5
    CVE-2026-108160

    AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

    AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can …

    iflytek astron-rpa
  • High 7.5
    CVE-2026-108159

    AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge

    AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection …

    iflytek astron-rpa
  • High 8.1
    CVE-2026-82475

    iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

    iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy pri…

    iflytek astron-agent