AS
Product
astron-agent
7
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 1High 2Medium 4Low 0
Watch
Add astron-agent to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-108263 | 9.9 | Oct 9 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE Affected: < 1.1.2 |
| CVE-2026-82475 | 8.1 | Aug 29 | iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check Affected: through 1.1.1 |
| CVE-2026-116339 New | 7.3 | Oct 26 | iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist Affected: 1.1.0; 1.1.1; 1.1.2 |
| CVE-2026-95930 | 6.3 | Sep 23 | iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +1 more |
| CVE-2026-95929 | 6.3 | Sep 23 | iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +2 more |
| CVE-2026-116340 New | 4.3 | Oct 26 | iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization Affected: 1.1.0; 1.1.1; 1.1.2 |
| CVE-2026-108864 | 4.2 | Oct 11 | iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint Affected: through 1.1.2 |
Showing 7