GHSA-4m32-cjv7-f425 — AstrBot is vulnerable to RCE with hard-coded JWT signing keys

The advisory, in context

Summary

AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin.

Details

AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python plugin that will be imported here, enabling arbitrary command execution on the target host.

Impact

All publicly accessible AstrBot instances are vulnerable.

For more information, please see: CVE-2025-55449-AstrBot-RCE

Patch

This vulnerability was first reported on 2025-06-21 and was patched on the same day (2025-06-21).

The vulnerability was publicly disclosed on 2025-11-14. Prior to public disclosure, monitoring from AstrBot Cloud indicated that fewer than 2% of deployed instances were still running the affected version. Therefore, this disclosure is not expected to have a significant impact on existing active instances.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

astrbot PyPI

Ecosystem versions

Earlier releases before 3.5.18

Fixed in 3.5.18

12 explicitly affected versions

3.4.39, 3.5.10, 3.5.11, 3.5.12, 3.5.13, 3.5.14, 3.5.15, 3.5.17, 3.5.6, 3.5.7, 3.5.8, 3.5.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "3.5.18"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.4.39",
    "3.5.10",
    "3.5.11",
    "3.5.12",
    "3.5.13",
    "3.5.14",
    "3.5.15",
    "3.5.17",
    "3.5.6",
    "3.5.7",
    "3.5.8",
    "3.5.9"
  ]
}

Set up in your agent.

Investigate in your agent.

AstrBot is vulnerable to RCE with hard-coded JWT signing keys