CVE-2026-6984
AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 25, 2026
- Updated
- Apr 27, 2026
- Reserved
- Apr 24, 2026
Description
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AstrBotAstrBotDevs |
|
References
- VDB-359527 | AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template enginevdb-entrytechnical-description
- VDB-359527 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #796164 | AstrBotDevs AstrBot 4.22.1 Server-Side Template Injectionthird-party-advisory
- https://github.com/AstrBotDevs/AstrBot/issues/7330exploitissue-tracking
- https://github.com/AstrBotDevs/AstrBot/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.