Unsandboxed code node in Astron Agent enables cross-tenant RCE
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-95.
Summary
Astron Agent from iflytek before 1.1.2 is affected. Its default workflow code node runs dynamic Python through LocalExecutor, which supplies full Python builtins without the documented sandbox restrictions (CWE-95). An authenticated user with low privileges can execute code as root in the core-workflow container and use shared service and database credentials to read or modify other tenants' data and disrupt shared services.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update iflytek astron-agent to version 1.1.2, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA astron-agent (iflytek) Fixed in 1.1.2
Timeline
- 2026-10-10 Threatist record created from CVE-2026-108263
- 2026-10-13 CISA SSVC decision points changed
References
Other 6
- https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5
- https://github.com/iflytek/astron-agent/pull/1650
- https://github.com/iflytek/astron-agent/pull/1651
- https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f
- https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36
- https://github.com/iflytek/astron-agent/releases/tag/v1.1.2
More iflytek vulnerabilities
- TI-2026-56868 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check CVSS 4.0HIGH 8.6
- TI-2026-80447 Incomplete blacklist in iFlytek astron-agent DDL Whitelist handler CVSS 4.0MEDIUM 6.9
- TI-2026-74423 Cross-tenant file disclosure in iFlytek AstronRPA CVSS 4.0MEDIUM 6.0
- TI-2026-80448 Authorization bypass in iFlytek astron-agent knowledge-list endpoint CVSS 4.0MEDIUM 5.3
- TI-2026-63726 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery CVSS 4.0MEDIUM 5.3
- TI-2026-70549 Account takeover via account merge flow in iFlytek SkillHub CVSS 4.0HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences