This vulnerability affects the create_template function in astrbot/dashboard/routes/t2i.py of AstrBotDevs AstrBot up to version 4.22.1. It results from improper neutralization of special elements used in the template engine, which can be manipulated remotely. The vulnerability is categorized under CWE-1336 (Improper Neutralization of Special Elements) and CWE-791 (Improper Handling of Inconsistent Code). The CVSS 4.0 base score is 5.1 (medium severity), indicating a network attack vector with low complexity and no user interaction required, but requiring high privileges. The vendor has not issued a patch or official remediation, and public exploit code exists.

Successful exploitation could allow remote attackers to manipulate template elements, potentially leading to unauthorized actions or information disclosure within the Dashboard API context. The CVSS score reflects a medium impact with low complexity but requiring high privileges, and limited confidentiality, integrity, and availability impact. No known exploits in the wild have been reported yet, but public exploit code availability increases risk.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates and apply any future patches promptly. Until a fix is released, consider restricting access to the affected Dashboard API component to trusted users only and apply additional input validation or filtering if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.