Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

Fix availableCritical · CVSS 9.8EPSS 0.28%

Published Nov 14, 2025 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: astrbot 3.5.18.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIastrbot35,588 downloads/week

Vulnerable versions
< 3.5.18
Fixed in
3.5.18

Check your project: pip show astrbot

Sources

CWE-321 Use of Hard-coded Cryptographic Key · CWE-345 Insufficient Verification of Data Authenticity · CWE-798 Use of Hard-coded Credentials

← All critical vulnerabilities