CVE-2026-108263: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in iflytek astron-agent

The vulnerability arises because the astron-agent's default workflow code-node path executes dynamic Python code with full builtins and without sandbox restrictions when CODE_EXEC_TYPE is not explicitly changed. This allows an authenticated low-privilege tenant to escalate privileges to root in the core-workflow container, access shared service and database credentials, bypass tenant-level access controls, and manipulate or disrupt data and services belonging to other tenants. The flaw is addressed in version 1.1.2.

An attacker with low-privilege authenticated access can achieve root code execution in the core-workflow container, leading to complete compromise of the container environment. This includes unauthorized access to shared credentials, bypassing tenant isolation, reading or modifying other tenants' data, and disrupting shared services, resulting in a critical impact on confidentiality, integrity, and availability.

Upgrade to astron-agent version 1.1.2 or later, where this vulnerability is fixed. Prior versions are vulnerable. No alternative mitigations are documented; patching is required.