Executive brief
AstrBot is an AI agent assistant and development framework that integrates with various messaging platforms and large language models. A security vulnerability in the plugin management system allows an authenticated user to upload and execute malicious code on the server. This could lead to a complete takeover of the bot's host environment, unauthorized access to connected messaging accounts, or theft of sensitive API keys and user data.
Technical details
A code injection vulnerability exists in AstrBot versions up to 4.22.1 within the plugin installation mechanism. The 'install_plugin_upload' function in 'astrbot/dashboard/routes/plugin.py' processes ZIP files uploaded to the '/api/plugin/install-upload' endpoint without sufficient validation. When a plugin is uploaded, the application extracts the archive and uses the Python '__import__()' function to dynamically load the module. Because there is no code signing, sandboxing, or static analysis performed on the uploaded content, an authenticated attacker can execute arbitrary Python code in the context of the server process by including malicious logic in the plugin's 'main.py'. While the vulnerability requires authentication, it can be exploited using default credentials or a valid JWT token.
Affected products
- AstrBotDevs AstrBot <= 4.22.1
Timeline
- 2026-03-26: other: Vulnerability discovered
- 2026-03-30: disclosed: Issue reported to the project maintainers via GitHub
- 2026-04-12: advisory: CVE published