# astrbot (PyPI) vulnerabilities 8 known vulnerabilities (3 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.29.4 (Oct 31, 2026): no advisory affects it - Newest unaffected release: 4.29.4 (Oct 31, 2026), the latest release - Weekly downloads: 28.8K - Dependents: 1 - Releases: 176 since 3.4.39 (May 1, 2025) - Registry: https://pypi.org/project/astrbot/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-10212: 3.4.39 to 4.24.2 (4.24.3 is outside it) - CVE-2026-8754: 3.4.39 to 4.23.5 (4.23.6 is outside it) - CVE-2025-55449: 3.4.39 to 3.5.17 (3.5.18 is outside it) - CVE-2026-7579: 3.4.39 to 4.16.0 (4.17.0 is outside it) - CVE-2026-6984: 3.4.39 to 4.22.1 (4.22.2 is outside it) - CVE-2025-57698: 3.4.39 to 3.5.22 (3.5.23 is outside it) - CVE-2025-57697: 3.4.39 to 3.5.22 (3.5.23 is outside it) - CVE-2025-48957: 3.4.39 to 3.5.12 (3.5.13 is outside it) ## Advisories (8) ### [CVE-2026-10212](https://cve.now/CVE-2026-10212): AstrBotDevs AstrBot astr\_main\_agent.py astr\_main\_agent authorization - Severity: Medium 5.3 - Published: Jun 1, 2026 - Affected: through 4.24.2. - Fixed in 4.24.3 (released May 12, 2026, 20 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.29.4, is not affected. ### [CVE-2026-8754](https://cve.now/CVE-2026-8754): AstrBotDevs AstrBot File Upload chat.py post\_file path traversal - Severity: Medium 5.3 - Published: May 17, 2026 - Affected: fixed in 4.23.6. - Fixed in 4.23.6 (released Apr 27, 2026, 20 days before disclosure). - The latest release, 4.29.4, is not affected. ### [CVE-2025-55449](https://cve.now/CVE-2025-55449): AstrBotDevs AstrBot 3.5.15 has Advanced\_System\_for\_Text\_Response\_and\_Bot\_Operations\_Tool as the hardcoded private key used to sign a JWT. - Severity: High 7.3 - Published: May 8, 2026 - Affected: fixed in 3.5.18. - Fixed in 3.5.18 (released Jun 29, 2025, 313 days before disclosure). - The latest release, 4.29.4, is not affected. ### [CVE-2026-7579](https://cve.now/CVE-2026-7579): AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials - Severity: Medium 6.9 - Published: May 1, 2026 - Affected: through 4.16.0. - Fixed in 4.17.0 (released Feb 15, 2026, 75 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.29.4, is not affected. ### [CVE-2026-6984](https://cve.now/CVE-2026-6984): AstrBotDevs AstrBot Dashboard API t2i.py create\_template special elements used in a template engine - Severity: Medium 5.1 - Published: Apr 25, 2026 - Affected: through 4.22.1. - Fixed in 4.22.2 (released Mar 28, 2026, 28 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.29.4, is not affected. ### [CVE-2025-57698](https://cve.now/CVE-2025-57698): AstrBot Project v3.5.22 contains a directory traversal vulnerability. - Severity: High 7.5 - Published: Nov 7, 2025 - Affected: through 3.5.22. - Fixed in 3.5.23 (released Jul 26, 2025, 104 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.29.4, is not affected. ### [CVE-2025-57697](https://cve.now/CVE-2025-57697): AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function \_encode\_image\_bs64. - Severity: Medium 6.5 - Published: Nov 7, 2025 - Affected: through 3.5.22. - Fixed in 3.5.23 (released Jul 26, 2025, 104 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.29.4, is not affected. ### [CVE-2025-48957](https://cve.now/CVE-2025-48957): AstrBot Has Path Traversal Vulnerability in /api/chat/get\_file - Severity: High 7.5 - Published: Jun 2, 2025 - Affected: from 3.4.4, fixed in 3.5.13. - Fixed in 3.5.13 (released May 31, 2025, 2 days before disclosure). - The latest release, 4.29.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/astrbot Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.