Skip to content
Fencer Vulns
medium 4.7

CVE-2026-6984 json

AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine

published 2026-04-25 6 mo ago modified 2026-10-26 13 d ago also GHSA-h3rr-9wqj-v3c6 , PYSEC-2026-2381 , EUVD-2026-25660

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/AstrBotDevs/AstrBot/issues/7330 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA 3.0 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA 2.0 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA 4.0 2.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CNA 2.0 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P
OSV 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
pypi astrbot
<=4.22.1
 no fix listed

Affected products

  • AstrBotDevs AstrBot

Classification

Weakness
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
  • CWE-791 Incomplete Filtering of Special Elements

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.