Vulnerabilities

TI-2025-35011 CVE-2025-55449 · GHSA-4m32-cjv7-f425

AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool…

LOW 38

AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00281 Published 2026-05-08 Fixed in 3.5.18 CWE-321

TI-2025-35605 CVE-2025-57698 · GHSA-xrj9-mw57-j34v

HIGH 66

AstrBot Project v3.5.22 contains a directory traversal vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00834 Published 2025-11-07 No fix listed CWE-22

TI-2025-35604 CVE-2025-57697 · GHSA-vm2f-46xc-5jc3

MEDIUM 62

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0034 Published 2025-11-07 No fix listed CWE-125

TI-2025-31095 CVE-2025-48957 · GHSA-cq37-g2qp-3c2p

HIGH 72

AstrBot is a large language model chatbot and development framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00771 Published 2025-06-02 Fixed in 3.5.13 CWE-23