Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A vulnerability was detected in AstrBotDevs AstrBot up to 4.23.5. Impacted is the function postfile of the file astrbot/dashboard/routes/chat.py of the component File Upload Handler. The manipulation of the argument filename results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 4.23.6 is recommended to address this issue. The patch is identified as aaec41e5054569ceaa1113593a34da7568e2d211. You should upgrade the affected component.
Recommended action: Upgrade to 4.23.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin. Details AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python plugin that will be imported here, enabling arbitrary command execution on the target host. Impact All publicly accessible AstrBot instances are vulnerable. For more information, please see: CVE-2025-55449-AstrBot-RCE Patch This vulnerability was first reported on 2025-06-21 and was patched on the same day (2025-06-21). The vulnerability was publicly disclosed on 2025-11-14. Prior to public disclosure, monitoring from AstrBot Cloud indicated…
Recommended action: Upgrade to 3.5.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability may lead to: Information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. Reproduce Follow these steps to set up a test environment for reproducing the vulnerability: 1. Install dependencies and clone the repository: 2. Alternatively, deploy the program via pip: 3. In another terminal, run the following command to exploit the vulnerability: This request will read the cmdconfig.json config file, leading to the leakage of sensitive data such as LLM API keys, usernames, and password hashes (MD5). Patches The vulnerability has been addressed in Pull Request #1676 and is included in versions = v3.5.13. All users are strongly encouraged to upgrade to v3.5.13 or later. Workarounds Users can edit the cmdconfig.json file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later as soon as possible to fully resolve this issue. References Pull…
Recommended action: Upgrade to 3.5.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.