AstrBot.

AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization

• AstrBot
• Broken access control

AstrBotDevs AstrBot astr_main_agent.py authorization

• AstrBot
• Broken access control

AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following

• AstrBot
• Path traversal

AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing

• AstrBot
• Authentication bypass

AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization

• AstrBot
• Broken access control

AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery

• AstrBot
• Server-side request forgery (SSRF)

AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting

• AstrBot
• Cross-site scripting (XSS)
• Code injection

AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery

• AstrBot
• Server-side request forgery (SSRF)

AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery

• AstrBot
• Server-side request forgery (SSRF)

AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization

• AstrBot
• Privilege escalation
• Broken access control

AstrBotDevs AstrBot API Endpoint delete path traversal

• AstrBot
• Path traversal

AstrBotDevs AstrBot fs.py _normalize_rw_path authorization

• AstrBot
• Broken access control

AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection

• AstrBot
• Other injection
• CWE-707

AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery

• AstrBot
• Server-side request forgery (SSRF)

AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection

• AstrBot
• Other injection
• Command injection

AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox

• AstrBot
• CWE-264
• CWE-265