CVE-2026-16073 Overview
CVE-2026-16073 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting AstrBotDevs AstrBot versions up to 4.25.2. The flaw resides in the Star.text_to_image and NetworkRenderStrategy.render functions within astrbot/core/star/base.py, part of the Text-to-Image (T2I) feature. An authenticated attacker can inject malicious script content that executes in the context of another user's browser session. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The vulnerability requires low privileges and user interaction, limiting exploitation impact to session-level integrity concerns.
Critical Impact
Remote attackers with low privileges can inject scripts through the T2I rendering pipeline, enabling session-context script execution against users who interact with attacker-controlled content.
Affected Products
- AstrBotDevs AstrBot versions up to and including 4.25.2
- Component: T2I (Text-to-Image) Feature
- File: astrbot/core/star/base.py
Discovery Timeline
- 2026-07-17 - CVE-2026-16073 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16073
Vulnerability Analysis
The vulnerability exists in AstrBot's T2I rendering pipeline, specifically in the Star.text_to_image method and the NetworkRenderStrategy.render function defined in astrbot/core/star/base.py. These functions accept text input intended for image rendering but fail to sanitize or encode HTML and JavaScript payloads before passing the content through the rendering strategy. When the network render strategy processes crafted input, embedded script content is preserved in the resulting HTML context.
The attack is network-reachable and requires authenticated access with low privileges. User interaction is required for successful exploitation, meaning a victim must view or trigger the rendered output. Impact is limited to integrity of the rendered content, with no direct effect on confidentiality or availability of the underlying host.
Root Cause
The root cause is missing output encoding and input sanitization in the T2I feature. User-supplied text passed to text_to_image is forwarded to NetworkRenderStrategy.render without HTML entity encoding or a content sanitization step, allowing raw markup and script tags to be embedded in rendered output [CWE-79].
Attack Vector
An authenticated attacker submits crafted text containing HTML or JavaScript payloads to the T2I feature. When the rendering strategy processes this text through the network render path, the payload is preserved. A victim user who views the rendered content executes the attacker-controlled script within their browser session. See the GitHub Gist PoC and VulDB CVE-2026-16073 entries for additional technical detail. No verified exploit code is republished here.
Detection Methods for CVE-2026-16073
Indicators of Compromise
- Text-to-Image submission payloads containing <script>, onerror=, onload=, or javascript: tokens in AstrBot logs.
- Rendered T2I output containing unescaped HTML tags or inline event handlers.
- Unexpected outbound requests originating from user browsers after viewing T2I-generated content.
Detection Strategies
- Inspect application logs for T2I input strings containing HTML control characters or script fragments prior to rendering.
- Deploy web application firewall (WAF) rules that flag XSS payload patterns targeting AstrBot endpoints tied to text_to_image.
- Perform code-level review of any custom render strategies extending NetworkRenderStrategy to confirm output encoding is applied.
Monitoring Recommendations
- Enable content security policy (CSP) violation reporting on the AstrBot web interface to surface script execution attempts.
- Monitor authenticated user sessions for anomalous DOM manipulation or unexpected navigation events following T2I interactions.
- Track version inventory of AstrBot deployments to identify hosts running vulnerable releases at or below 4.25.2.
How to Mitigate CVE-2026-16073
Immediate Actions Required
- Restrict access to the T2I feature to trusted users until an upstream fix is released.
- Apply a strict Content Security Policy that disallows inline scripts on interfaces that render T2I output.
- Audit astrbot/core/star/base.py and downstream render strategies for missing output encoding and patch locally if maintaining a fork.
Patch Information
No vendor patch is currently available. Per the disclosure record on VulDB Vulnerability #379788, the vendor was contacted but did not respond. Monitor the AstrBot project for future releases addressing this issue.
Workarounds
- Disable the T2I feature in AstrBot configuration where it is not required for operations.
- Wrap calls to Star.text_to_image with an HTML-encoding pre-processor that neutralizes <, >, ", ', and & characters in untrusted input.
- Enforce network segmentation so that only authenticated internal users can reach AstrBot instances exposing the T2I endpoint.
# Example: apply a strict CSP header at the reverse proxy in front of AstrBot
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
