PyPIPackage

astrbot

8 known vulnerabilities (3 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 4.29.4 (Oct 31, 2026): no advisory affects it
Newest unaffected release: 4.29.4 (Oct 31, 2026), the latest release
Advisories: 8 · 3 high, 5 medium

Weekly downloads: 28.8K
Dependents: 1
Releases: 176 since 3.4.39 (May 1, 2025)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-10212
Affects 3.4.39 to 4.24.2 (4.24.3 is outside it)
CVE-2026-8754
Affects 3.4.39 to 4.23.5 (4.23.6 is outside it)
CVE-2025-55449
Affects 3.4.39 to 3.5.17 (3.5.18 is outside it)
CVE-2026-7579
Affects 3.4.39 to 4.16.0 (4.17.0 is outside it)
CVE-2026-6984
Affects 3.4.39 to 4.22.1 (4.22.2 is outside it)
CVE-2025-57698
Affects 3.4.39 to 3.5.22 (3.5.23 is outside it)
CVE-2025-57697
Affects 3.4.39 to 3.5.22 (3.5.23 is outside it)
CVE-2025-48957
Affects 3.4.39 to 3.5.12 (3.5.13 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-10212Medium 5.3
AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization
Affected: through 4.24.2.
Fixed in 4.24.3 (released May 12, 2026, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.29.4, is not affected.
CVE-2026-8754Medium 5.3
AstrBotDevs AstrBot File Upload chat.py post_file path traversal
Affected: fixed in 4.23.6.
Fixed in 4.23.6 (released Apr 27, 2026, 20 days before disclosure).
The latest release, 4.29.4, is not affected.
CVE-2025-55449High 7.3
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
Affected: fixed in 3.5.18.
Fixed in 3.5.18 (released Jun 29, 2025, 313 days before disclosure).
The latest release, 4.29.4, is not affected.
CVE-2026-7579Medium 6.9
AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials
Affected: through 4.16.0.
Fixed in 4.17.0 (released Feb 15, 2026, 75 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.29.4, is not affected.
CVE-2026-6984Medium 5.1
AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine
Affected: through 4.22.1.
Fixed in 4.22.2 (released Mar 28, 2026, 28 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.29.4, is not affected.
CVE-2025-57698High 7.5
AstrBot Project v3.5.22 contains a directory traversal vulnerability.
Affected: through 3.5.22.
Fixed in 3.5.23 (released Jul 26, 2025, 104 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.29.4, is not affected.
CVE-2025-57697Medium 6.5
AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.
Affected: through 3.5.22.
Fixed in 3.5.23 (released Jul 26, 2025, 104 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 4.29.4, is not affected.
CVE-2025-48957High 7.5
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
Affected: from 3.4.4, fixed in 3.5.13.
Fixed in 3.5.13 (released May 31, 2025, 2 days before disclosure).
The latest release, 4.29.4, is not affected.