AstrBotDevs AstrBot suffers from a command injection flaw in the add_mcp_server endpoint. By inserting special characters into the command argument, an attacker can execute arbitrary operating‑system commands on the host that runs the service. This flaw is identified as CWE‑74 and CWE‑77, and it can lead to full compromise of confidentiality, integrity, and availability of the compromised machine.

The vulnerability exists in AstrBot releases up to and including version 4.22.1. The affected component is the MCP Endpoint’s tools.py file, located at astrbot/dashboard/routes/tools.py. Users who maintain any of these versions or earlier ones should be aware that the link used by add_mcp_server is exposed to remote callers, providing a vector for exploitation.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is 3% and the vulnerability has not been added to CISA’s KEV catalog. The attack can be carried out remotely, and the exploit has been publicly disclosed, meaning that, until a vendor fix is published, the risk remains until the endpoint is disabled or the system is upgraded.