A flaw in the create_template function of AstrBot’s Dashboard API causes the template engine to fail to neutralize special elements in user‑supplied templates. Because the engine accepts these elements without proper escaping, crafted template content can be executed by the server, potentially allowing an attacker to modify application behavior or inject malicious code into the rendering process. The CVE description does not explicitly confirm that arbitrary code execution is guaranteed, but the weakness could be leveraged for further compromise.

The vulnerability affects AstrBotDevs AstrBot versions up to and including 4.22.1. The affected component is the Dashboard API, specifically the t2i.py route that processes create_template requests. All deployments of the product before the 4.22.1 release are potentially susceptible.

The CVSS base score of 5.1 places the flaw in the moderate severity range, while the EPSS score of <1% indicates a very low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, but the availability of a public exploit suggests that attackers can target the create_template endpoint remotely. The likely attack vector is an HTTP request that supplies a malicious template payload to the API endpoint. Given the low EPSS, the risk is moderate but should still be monitored.