AstrBot up to version 4.22.1 contains a vulnerability in the create_template function of the Dashboard API component. This flaw involves improper neutralization of special elements in a template engine, which can be exploited remotely. The vulnerability has a medium severity score and public exploit code is available. The project has been informed but has not yet issued a response or patch.