CVE-2026-16073

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot versions prior to 4.25.3

Description A remote cross-site scripting issue exists within the T2I Feature component. The flaw is located in the Star.text to image/NetworkRenderStrategy.render() function within the astrbot/core/star/base.py file, allowing an attacker to execute malicious scripts remotely.

Recommendations Update AstrBotDevs AstrBot to version 4.25.3 or later. As a temporary workaround, restrict access to the Star.text to image/NetworkRenderStrategy.render() function.