pkg:PyPI/astrbot

All known vulnerabilities

• CRITICAL9.8CVE-2025-55449AstrBot is vulnerable to RCE with hard-coded JWT signing keys
  from 0, < 3.5.18
• HIGH7.5CVE-2025-48957AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
  >= 3.4.4, < 3.5.13
• HIGH7.5CVE-2025-48957AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
  >= 3.4.4, < 3.5.13
• HIGH7.3AstrBot Makes Use of Hard-coded Password
  from 0, <= 4.16.0
• HIGH7.3AstrBot Makes Use of Hard-coded Password
  from 0, <= 4.16.0
• MEDIUM6.3AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass
  from 0, <= 4.24.2
• MEDIUM6.3AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass
  from 0, <= 4.24.2
• MEDIUM6.3AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
  from 0, < 4.23.6
• MEDIUM6.3AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
  from 0, < 4.23.6
• MEDIUM4.7AstrBot has Incomplete Filtering of Special Elements
  from 0, <= 4.22.1
• MEDIUM4.7AstrBot has Incomplete Filtering of Special Elements
  from 0, <= 4.22.1
• —AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
  from 0, <= 3.5.22
• —AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
  from 0, <= 3.5.22
• —AstrBot contains a directory traversal vulnerability
  from 0, <= 3.5.22
• —AstrBot contains a directory traversal vulnerability
  from 0, <= 3.5.22