Astrbot

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Astrbot records in CISA KEV

No Astrbot vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in Astrbot · all components

TI-2025-31095 CVE-2025-48957 · GHSA-cq37-g2qp-3c2p

HIGH 72

AstrBot is a large language model chatbot and development framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00771 Published 2025-06-02 Fixed in 3.5.13 CWE-23

TI-2025-35605 CVE-2025-57698 · GHSA-xrj9-mw57-j34v

HIGH 66

AstrBot Project v3.5.22 contains a directory traversal vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00834 Published 2025-11-07 No fix listed CWE-22

TI-2025-35604 CVE-2025-57697 · GHSA-vm2f-46xc-5jc3

MEDIUM 62

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0034 Published 2025-11-07 No fix listed CWE-125

TI-2025-35011 CVE-2025-55449 · GHSA-4m32-cjv7-f425

LOW 38

AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00281 Published 2026-05-08 Fixed in 3.5.18 CWE-321