Threats affecting pkg:github/iflytek/astron-agent

CVE-2026-108263 is a critical vulnerability in iflytek's astron-agent prior to version 1.1.2. It involves improper neutralization of directives in dynamically evaluated code, allowing an authenticated low-privilege tenant to execute arbitrary code as root within the core-workflow container. This can lead to unauthorized access to shared service and database credentials, bypassing tenant isolation, and enabling data compromise or service disruption. The issue is fixed in version 1.1.2.

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded.

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component.