CVE-2026-16073 is a cross-site scripting vulnerability affecting AstrBotDevs AstrBot up to version 4.25.2. The flaw resides in the Star.text_to_image/NetworkRenderStrategy.render function of the astrbot/core/star/base.py file, part of the T2I Feature component. This vulnerability allows remote attackers to inject malicious scripts, potentially leading to script execution in the victim's browser. The vulnerability has been publicly disclosed, but the vendor has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with no confidentiality or availability impact and low integrity impact.

Successful exploitation of this vulnerability could allow remote attackers to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected application. This may result in unauthorized actions performed on behalf of users or theft of sensitive information accessible via the browser session. However, the impact is limited to medium severity as per the CVSS score, with no direct confidentiality or availability impact reported.

No official fix or patch is currently available for this vulnerability, and the vendor has not responded to the disclosure. Users and administrators should monitor the vendor's communications for any future updates or patches. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block potential XSS payloads targeting the affected functions. Avoid exposing the vulnerable component to untrusted users if possible.