CVE-2026-6118 | AstrBotDevs AstrBot up to 4.22.1 MCP Endpoint tools.py add_mcp_server command command injection (Issue 7169)

A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. It has been classified as critical. Impacted is the function add_mcp_server of the file astrbot/dashboard/routes/tools.py of the component MCP Endpoint. This manipulation of the argument command causes command injection.

This vulnerability is tracked as CVE-2026-6118. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.