PT-2026-59063 · Pypi · Astrbot

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr main agent of the file astrbot/core/astr main agent.py. Such manipulation of the argument session id leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Correção

Identificadores relacionados

PYSEC-2026-2383

Produtos afetados

Astrbot

Referências · 10

• https://github.com/AstrBotDevs/AstrBot · Nota
• https://vuldb.com/vuln/367491/cti · Nota
• https://osv.dev/vulnerability/PYSEC-2026-2383 · Aviso do Fabricante
• https://gist.github.com/YLChen-007/91a7f955143099e1747424707dfad0f9 · Nota
• https://github.com/advisories/GHSA-r6vm-4xwg-w69h · Nota
• https://vuldb.com/vuln/367491 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-10212 · Nota de Segurança
• https://pypi.org/project/astrbot · Nota
• https://vuldb.com/submit/821923 · Nota
• https://vuldb.com/cve/CVE-2026-10212 · Nota