CVE-2026-95929: iFlytek astron-agent SQL Injection Flaw

CVE-2026-95929 Overview

CVE-2026-95929 is a SQL injection vulnerability in iFlytek astron-agent versions up to 1.0.7. The flaw resides in the getBotList API endpoint, specifically within the MyBatis mapper file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml. An authenticated attacker can manipulate the sortDirection argument to inject arbitrary SQL fragments into the generated ORDER BY clause. The issue is remotely exploitable over the network and has been assigned CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote authenticated attackers can inject SQL into backend queries of the astron-agent console, potentially exposing or altering chatbot and user data stored by the platform.

Affected Products

iFlytek astron-agent versions up to and including 1.0.7
Component: getBotList API endpoint
File: console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml

Discovery Timeline

2026-09-23 - CVE-2026-95929 published to NVD
2026-09-23 - Last updated in NVD database
Patch commit - 6702be70ae802b1048f5fbec91e690e7b71a4165 merged via Pull Request #1342, released as reward-1575

Technical Details for CVE-2026-95929

Vulnerability Analysis

The getBotList endpoint accepts a client-supplied sortDirection parameter used to order chatbot market listings. The MyBatis XML mapper interpolated this value directly into the SQL statement using the ${} syntax instead of the parameterized #{} placeholder. Because ${} performs raw string substitution, any content passed in sortDirection becomes part of the generated SQL, bypassing prepared statement protections. An attacker can append additional SQL clauses, UNION selects, or time-based payloads through this parameter. The endpoint requires low-privilege authentication but no user interaction.

Root Cause

The root cause is unsafe dynamic SQL construction in the ordering logic of ChatBotMarketMapper.xml. The sortDirection field on BotQueryCondition was not validated against an allow-list of legal values such as ASC or DESC. Combined with MyBatis ${} interpolation, this created a direct SQL injection sink in the ORDER BY clause for the createTime and updateTime sort fields.

Attack Vector

An authenticated user issues a request to the getBotList API endpoint with a crafted sortDirection value. Because the value is concatenated into the query string, the attacker can terminate the ORDER BY clause and append arbitrary SQL. Exploitation is remote, requires no user interaction, and can be automated against exposed astron-agent consoles.

java

// Patched code from BotQueryCondition.java
        if (uid == null) {
            throw new IllegalArgumentException("User ID cannot be null");
        }
        this.sortDirection = getSafeSortDirection();

Source: GitHub commit 6702be7

xml

<!-- Patched ChatBotMarketMapper.xml: ${sortDirection} replaced with ${safeSortDirection} -->
            <when test="condition.sortField != null">
                <choose>
                    <when test="condition.sortField == 'createTime'">
                        ORDER BY a.create_time ${condition.safeSortDirection}
                    </when>
                    <when test="condition.sortField == 'updateTime'">
                        ORDER BY a.update_time ${condition.safeSortDirection}
                    </when>
                    <otherwise>
                        ORDER BY a.create_time DESC

Source: GitHub commit 6702be7

The fix introduces a getSafeSortDirection() helper that validates the input against an allow-list before the mapper uses it.

Detection Methods for CVE-2026-95929

Indicators of Compromise

Requests to the getBotList API endpoint containing sortDirection values other than ASC or DESC.
Presence of SQL keywords (UNION, SELECT, SLEEP, --, /*) within the sortDirection query parameter or JSON body field.
Unexpected database errors or long-running queries originating from the astron-agent backend after getBotList calls.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects sortDirection parameters on astron-agent endpoints and blocks non-allow-listed values.
Enable database query logging and alert on ORDER BY clauses containing subqueries, unions, or delay functions.
Correlate authentication logs with API access patterns to identify low-privilege accounts issuing anomalous getBotList traffic.

Monitoring Recommendations

Monitor HTTP 500 responses and JDBC exceptions from the astron-agent console backend for spikes tied to specific user sessions.
Track outbound egress from the database host, which could indicate exfiltration through injected queries.
Review MyBatis mapper files across the codebase for other uses of ${} interpolation that may share the same root cause pattern.

How to Mitigate CVE-2026-95929

Immediate Actions Required

Upgrade astron-agent to release reward-1575 or later, which includes commit 6702be7.
Restrict network access to the astron-agent console to trusted administrators until the patch is deployed.
Rotate database and application credentials if injection attempts are observed in logs.

Patch Information

The vendor addressed the issue in commit 6702be70ae802b1048f5fbec91e690e7b71a4165, delivered via Pull Request #1342 and tagged as release reward-1575. The patch replaces the tainted ${condition.sortDirection} interpolation with a sanitized ${condition.safeSortDirection} value produced by an allow-list validator. See the GitHub issue tracker entry #1329 for the original report.

Workarounds

Add a reverse-proxy or WAF rule that rejects requests where sortDirection is not exactly ASC or DESC (case-insensitive).
Enforce least-privilege on the database account used by astron-agent so injected queries cannot read or modify unrelated schemas.
Disable or firewall the getBotList endpoint if the chatbot market functionality is not required in your deployment.

bash

# Example nginx rule to allow-list sortDirection values
location /api/bot/getBotList {
    if ($arg_sortDirection !~* "^(ASC|DESC)$") {
        return 400;
    }
    proxy_pass http://astron_backend;
}