CVE-2026-116339

HIGH 7.3

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-184 CWE-183
Vendor	iflytek
Product	astron-agent
Published	Oct 26, 2026
Last Updated	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for iflytek astron-agent

Be the first to know when new high vulnerabilities affecting iflytek astron-agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

iFlytek / astron-agent

1.1.0 1.1.1 1.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426314 vuldb.com: https://vuldb.com/vuln/426314/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116339 vuldb.com: https://vuldb.com/submit/1011581 github.com: https://github.com/Rinne666/poc/tree/main/astron-agent-poc github.com: https://github.com/Rinne666/poc/blob/main/astron-agent-poc/poc/v1_ddl_whitelist_comment_smuggling.py

Credits

🔍 qyf20051010 (VulDB User) VulDB CNA Team