PT-2026-32150 · Astrbot · Astrbot

Yu_Bao · CVE-2026-6118 · Published 2026-04-12 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBot versions up to 4.22.1

Description A command injection issue exists in AstrBotDevs AstrBot up to version 4.22.1. The add mcp server function within the astrbot/dashboard/routes/tools.py file, part of the MCP Endpoint component, is affected. Manipulation of the command argument can lead to remote command injection. The exploit has been publicly disclosed.

Recommendations Versions prior to 4.22.1 are recommended.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-6118

Affected Products

Astrbot

References · 13

• 🔥 https://github.com/AstrBotDevs/AstrBot/issues/7169 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6118.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-6118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6118 · Security Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://vuldb.com/vuln/356978 · Note
• https://twitter.com/CVEarity/status/2043333490612249000 · Twitter Post
• https://twitter.com/infoflowcloud/status/2043221614557348022 · Twitter Post
• https://twitter.com/CVEnew/status/2043220240578834859 · Twitter Post
• https://vuldb.com/submit/792655 · Note
• https://twitter.com/pdnuclei_bot/status/2044158782973132837 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043202053678256199 · Twitter Post
• https://vuldb.com/vuln/356978/cti · Note