CRITICAL9.8PyPI
GHSA-4m32-cjv7-f425· CVE-2025-55449, PYSEC-2026-285AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Modified: 6/29/2026
package
PyPI/astrbot
pkg:pypi/astrbot
HIGH7.5PyPI
GHSA-cq37-g2qp-3c2p· CVE-2025-48957, PYSEC-2026-1196AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
Modified: 9/10/2026
MEDIUM6.3PyPI
GHSA-f63h-wc26-pmvc· CVE-2026-8754, PYSEC-2026-2380AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
Modified: 7/13/2026
MEDIUM4.7PyPI
GHSA-h3rr-9wqj-v3c6· CVE-2026-6984, PYSEC-2026-2381AstrBot has Incomplete Filtering of Special Elements
Modified: 7/13/2026
HIGH7.3PyPI
GHSA-mq9q-25hm-g4gp· CVE-2026-7579, GHSA-vrqm-xcfv-286rAstrBot Makes Use of Hard-coded Password
Modified: 7/13/2026
MEDIUM6.3PyPI
GHSA-r6vm-4xwg-w69h· CVE-2026-10212, PYSEC-2026-2383AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass
Modified: 7/13/2026
MEDIUMPyPI
GHSA-vm2f-46xc-5jc3· CVE-2025-57697, PYSEC-2026-1197AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
Modified: 7/7/2026
HIGHPyPI
GHSA-xrj9-mw57-j34v· CVE-2025-57698, PYSEC-2026-1198AstrBot contains a directory traversal vulnerability
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1196· CVE-2025-48957, GHSA-cq37-g2qp-3c2pAstrBot Has Path Traversal Vulnerability in /api/chat/get_file
Modified: 7/7/2026
—PyPI
PYSEC-2026-1197· CVE-2025-57697, GHSA-vm2f-46xc-5jc3AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64
Modified: 7/7/2026
—PyPI
PYSEC-2026-1198· CVE-2025-57698, GHSA-xrj9-mw57-j34vAstrBot contains a directory traversal vulnerability
Modified: 7/7/2026
MEDIUM6.3PyPI
PYSEC-2026-2380· CVE-2026-8754, GHSA-f63h-wc26-pmvcAstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
Modified: 7/13/2026
MEDIUM4.7PyPI
PYSEC-2026-2381· CVE-2026-6984, GHSA-h3rr-9wqj-v3c6AstrBot has Incomplete Filtering of Special Elements
Modified: 7/13/2026
HIGH7.3PyPI
PYSEC-2026-2382· CVE-2026-7579, GHSA-mq9q-25hm-g4gpAstrBot Makes Use of Hard-coded Password
Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-2383· CVE-2026-10212, GHSA-r6vm-4xwg-w69hAstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-285· CVE-2025-55449, GHSA-4m32-cjv7-f425AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Modified: 7/1/2026