Executive brief
AstrBot is an AI agent assistant and development framework used to integrate large language models with various messaging platforms. A security vulnerability in the dashboard allows an authenticated user to execute arbitrary system commands on the server hosting the application. This could lead to a complete takeover of the server, unauthorized access to sensitive data, or disruption of the AI assistant services.
Technical details
A command injection vulnerability exists in AstrBot versions up to 4.22.1 within the MCP (Model Context Protocol) server configuration component. The vulnerability is located in the `add_mcp_server` function in `astrbot/dashboard/routes/tools.py`. The application accepts user-supplied configuration data via the `/api/tools/mcp/add` and `/api/tools/mcp/update` endpoints, including 'command' and 'args' fields, which are passed to a subprocess execution during a connection test without proper validation. An authenticated attacker with dashboard access can exploit this to execute arbitrary system commands. As of the advisory date, the project has been notified but a formal patch has not been confirmed.
Affected products
- AstrBotDevs AstrBot up to 4.22.1
Timeline
- 2026-03-26: disclosed: Vulnerability discovered
- 2026-03-30: other: Issue reported to vendor via GitHub issue #7169
- 2026-04-12: advisory: CVE published