# CVE-2026-16073: AstrBotDevs AstrBot XSS in T2I Feature

Source: https://junglewise.ai/threats/cve-2026-16073-astrbotdevs-astrbot-xss-in-t2i-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-16073 · Severity: low · CVSS 3.5 · Published 2026-07-17

AstrBot, a chatbot framework, contains a security flaw in its text-to-image (T2I) feature which converts long text replies into images. An attacker can send specially crafted messages that break out of the image-generation template to execute malicious scripts in the context of the image renderer. This could allow an attacker to tamper with generated content or falsify information presented to users.

## Quick answers

**Is CVE-2026-16073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16073 being exploited in the wild.

**How severe is CVE-2026-16073?** Low severity, with a CVSS score of 3.5, published 17 July 2026.

**Which products and versions are affected?** AstrBotDevs AstrBot up to 4.25.2.

**Is there a fix for CVE-2026-16073?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16073 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16073?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (XSS) vulnerability exists in AstrBot's T2I feature within the `Star.text_to_image` and `NetworkRenderStrategy.render` functions in `astrbot/core/star/base.py`. The root cause is the use of the `| safe` filter in Jinja2 templates (such as `base.html`), which disables HTML escaping for the `text` variable. An attacker with the ability to provide input to the T2I renderer (e.g., via authenticated chat or API flows) can inject a payload like `</textarea><script>alert(1)</script>` to break out of the hidden textarea container. This results in script execution within the remote or browser-based renderer context. While the vendor was contacted, no patch has been confirmed at the time of disclosure.

## Affected products

- AstrBotDevs AstrBot up to 4.25.2

## Timeline

- 2026-06-09: disclosed: Initial discovery and Gist publication
- 2026-07-17: advisory: CVE-2026-16073 published via VulDB/NVD

## References

- [https://gist.github.com/YLChen-007/2abcecece4369c46cc8405e597c0528b](https://gist.github.com/YLChen-007/2abcecece4369c46cc8405e597c0528b)
- [https://vuldb.com/cve/CVE-2026-16073](https://vuldb.com/cve/CVE-2026-16073)
- [https://vuldb.com/submit/852825](https://vuldb.com/submit/852825)
- [https://vuldb.com/vuln/379788](https://vuldb.com/vuln/379788)
- [https://vuldb.com/vuln/379788/cti](https://vuldb.com/vuln/379788/cti)