# CVE-2026-10210: AstrBotDevs AstrBot prompt injection in skill_manager.py

Source: https://junglewise.ai/threats/cve-2026-10210-astrbotdevs-astrbot-prompt-injection-in-skill-manager-py  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10210 · Severity: medium · CVSS 6.3 · Published 2026-06-01

AstrBot, a chatbot framework, is vulnerable to a system prompt injection flaw. An authorized user can upload a specially crafted skill file that bypasses security filters to hijack the underlying Large Language Model (LLM). This allows an attacker to override the bot's instructions, potentially leading to unauthorized data access or the execution of malicious commands.

## Quick answers

**Is CVE-2026-10210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10210 being exploited in the wild.

**How severe is CVE-2026-10210?** Medium severity, with a CVSS score of 6.3, published 1 June 2026.

**Which products and versions are affected?** AstrBotDevs AstrBot 4.23.6.

**Is there a fix for CVE-2026-10210?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10210 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10210?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A system prompt injection vulnerability exists in AstrBot 4.23.6 within the `build_skills_prompt()` function in `astrbot/core/skills/skill_manager.py`. While the application includes a `_sanitize_prompt_description()` function designed to strip backticks and collapse newlines, this sanitization is only applied to skills with a `source_type` of `sandbox_only`. Skills uploaded locally via the dashboard are assigned a `source_type` of `local_only`, bypassing these checks. An authenticated attacker can upload a ZIP archive containing a `SKILL.md` file with a YAML literal block scalar in the description field. This allows the injection of multiline instructions and markdown code fences into the LLM's system prompt, enabling the attacker to break out of the skill description context and issue arbitrary directives to the model.

## Affected products

- AstrBotDevs AstrBot 4.23.6

## Timeline

- 2026-04-29: disclosed: Initial discovery and Gist publication
- 2026-06-01: advisory: CVE published via VulDB/NVD

## References

- [https://gist.github.com/YLChen-007/f9d45a9c68b15a382677a820ee881bbb](https://gist.github.com/YLChen-007/f9d45a9c68b15a382677a820ee881bbb)
- [https://vuldb.com/cve/CVE-2026-10210](https://vuldb.com/cve/CVE-2026-10210)
- [https://vuldb.com/submit/821920](https://vuldb.com/submit/821920)
- [https://vuldb.com/vuln/367489](https://vuldb.com/vuln/367489)
- [https://vuldb.com/vuln/367489/cti](https://vuldb.com/vuln/367489/cti)