PT-2026-32150

CVE-2026-6118

Published

2026-04-12

Updated

2026-04-14

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBot versions up to 4.22.1

Description A command injection issue exists in AstrBotDevs AstrBot up to version 4.22.1. The add mcp server function within the astrbot/dashboard/routes/tools.py file, part of the MCP Endpoint component, is affected. Manipulation of the command argument can lead to remote command injection. The exploit has been publicly disclosed.

Recommendations Versions prior to 4.22.1 are recommended.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')