{"id":"CVE-2026-108263","summary":"Astron Agent: Unsandboxed code-node leads to cross-tenant RCE","details":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","aliases":["GHSA-mh3w-4q3f-2fg5"],"modified":"2026-10-11T07:04:28.133849002Z","published":"2026-10-09T20:47:38.407Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108263.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1392","CWE-306","CWE-653","CWE-863","CWE-95"]},"references":[{"type":"WEB","url":"https://github.com/iflytek/astron-agent/releases/tag/v1.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108263.json"},{"type":"ADVISORY","url":"https://github.com/iflytek/astron-agent/security/advisories/GHSA-mh3w-4q3f-2fg5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108263"},{"type":"FIX","url":"https://github.com/iflytek/astron-agent/commit/848daba03e5e045435863815be7ab6dfbcefc18f"},{"type":"FIX","url":"https://github.com/iflytek/astron-agent/commit/ebf074a431e96da0ad9e0a56409d3d2da15eae36"},{"type":"FIX","url":"https://github.com/iflytek/astron-agent/pull/1650"},{"type":"FIX","url":"https://github.com/iflytek/astron-agent/pull/1651"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/iflytek/astron-agent","events":[{"introduced":"0"},{"fixed":"848daba03e5e045435863815be7ab6dfbcefc18f"},{"fixed":"ebf074a431e96da0ad9e0a56409d3d2da15eae36"},{"fixed":"189600dd691e8562bd0b9f7112727b107b8a2e10"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["reward-1575","v1.1.1","v1.1.0","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v1.0.0-rc.9","v1.0.0-rc.8","v1.0.0-rc.7","v1.0.0-rc.6","v1.0.0-rc.5","v1.0.0-rc.3","v1.0.0-rc.4","v1.0.0-rc.2"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-108263-03f27b27","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxService.java","function":"createTool"},"deprecated":false,"digest":{"function_hash":"145665750332652998793170877799650921305","length":989}},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"RedirectingUrlCheckTool","file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java"},"deprecated":false,"digest":{"function_hash":"126597179216779494238743627527458362254","length":83},"id":"CVE-2026-108263-09a353e8","signature_type":"Function"},{"target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkUrlRejectsLoopbackAddressDirectly"},"deprecated":false,"digest":{"function_hash":"326503463091719044608717239439393450621","length":174},"id":"CVE-2026-108263-0ec47433","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"mockConfigMapper","file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java"},"deprecated":false,"digest":{"function_hash":"15798884130536393469414405158205984826","length":537},"id":"CVE-2026-108263-1ef3e21c","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkUrlAllowsIpInWhitelistCidr"},"deprecated":false,"digest":{"function_hash":"238530717923839052819922733491389256568","length":489},"id":"CVE-2026-108263-2694605c","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81975688688114194541543814084977080561","63863479522307411188302446502181584377","24567577847358492394997626415475802267","208072094533621956219382396106006830691","307589644859828685477092673663660793117","16623288292473881620025950089387149921","91695140628511203270798588995827827958","144831227175572226178880219358802622817","54472981448241789959703336212930665082","139151761172785706097648667699954410129","22910007986346944048407479102611908433","177357907067276205982889567222819937754","171221367782322238196575632104635004952","201385842787030071714097395844882086152","215156793189799991435425587051228972545","172452296199562687451441423387548809650","310747080167183098425213468789311666160","116017365362641058797243895198681004837","60690285980454715141071467838388946944","246287949020590419675681719942118455654","110362639231643073741313354098179647355","171663891800539611363397370904896404847","158305037479938426187765268033472071465","189214927677652364317606224375121598181","147953237777788485327556622276800843378","174703843748295831691962358388774260845","306189632978253030515227232128590134292","333620531336504270782406708951822262228","116692014205722389585058027121392987468","95677316336108806348298217661817737080","25979799541887974214190082841829108466","78510886916921194344400830720871466317","32944111518525332874941073605551029987","152096744670268207115562637531437220433","80804085144689794336240214498310763396","261622949954080378364047188353599376564","277094832871519271676243199225164788049","46231614630044196296566090494739053404","96169357061547490442011855224540720837","307265057512142771035144519547133490419","245226537772803245233225954218993847942","260859218473570353584094084535757807790","117313298710764542941972511999210361634","217379307425608462148542920362229209064","84622196946105298222749123659634316476","246287949020590419675681719942118455654","110362639231643073741313354098179647355","325118520559232966712037689683172556028","49730715538658291953788908584469449566","310117531412336448725396621010796652490","2327115814625364027140048072634018179","174703843748295831691962358388774260845","306189632978253030515227232128590134292","195748401424896100856902916097277959146","24688829511851733395252938629051845945","182923050379300614307586983644503968983","230757234566983183410393738837427860983","105726705618769457933046823622194887570","56725694093493303040315763180376751989","82523725424727836128984635641311015185","6318615899621486748005812645116549006","64997653862576203876206130272557958064","325259346135834480064889480870659410477","176498373080449604905168957370130667127","276794883486611508023343344787264762818","99341122608117707903746754135863676484","93588397557195380623801137449011065545","209169100985077818962995221750291252300","139912601203065216238332619421270271833","190588149593763566764742738845820054224","131518706468950250626044045548132693545","190738950110811897329526246061365781032","52219928739577358939309717419923007795","82829236052887929778900668646081225549","324996897603879763275165083892321439990","313720410684096629098731458221972968711","128066121472276136825156979510941192445","261934766582897066533467212286219711732","147898363961205396676838021240888301652","18095555857271850628557884554714564934","247687986036668297615166619597503429812","266985043067008151812152672882991165698","108381463446408979170561694588957244834","50410735383528808512641125105668395872","29254334205738344032940903333676240611","238497696929453743875114444638913257291","166425198749840210494322040040801256116","268604650018289438100255559951027494771","74915486264218784709651231381162602701","218069866994409174638176172307182600273","297579609180169425197744496469910727528","63759363071263530283037298670852376498","246287949020590419675681719942118455654","139937307939034314418611546019209325666","122807687563589573524643320615600133836","308904415005468104016379733277488852558","99877675410820449541580022853095114451","90540653279017574282575475406507106065","174703843748295831691962358388774260845","306189632978253030515227232128590134292","58681086715996409864602415975133730137","96984530657994779770410938971914018993","204208056629303403065920433713685527465","145912265557321954670331451030841688049","68698389416513827470699340424371253694","74915486264218784709651231381162602701","218069866994409174638176172307182600273","297579609180169425197744496469910727528","63759363071263530283037298670852376498","246287949020590419675681719942118455654","139937307939034314418611546019209325666","122807687563589573524643320615600133836","308904415005468104016379733277488852558","99877675410820449541580022853095114451","90540653279017574282575475406507106065","174703843748295831691962358388774260845","306189632978253030515227232128590134292","258981234511062849596465701005285965583","159354468814285269276345378683527301982","189175604778953996746582166088666171575","258026590818195156140166934352346023665","302451645590911184904243826387788568459","14494473571512185851019245701561211615","145505869898152750544506269707222294520","81829789624169293564530807073125657518","201107550845016997724276566122766067360","140811424442380807283334295818486106784","74774685931949356973249031924505824181","231592459523532449642343869022759845565","324765520724570877574213201401794887068","18765060041128055189704839956753022301","99420899961215924788104904208486967403","58148734984020472590934675782476605718","271254454361858650526292763920465501820","171132232622390315882636172046323387754","143302401687361684079796084523756987513","250250881320283605376292951497925919662","19200105742584749689017260736428780818","244726533848231174615950526246151849063","82878444999578593033316846201361110082","178530491277977912501465181423966530396","186526295548145996980916960716826938000","261671130614195464268609556144204172415","319372783170460026747827281991360190875","60302428017880881172979207530234041137","189073756352298288912261923088939885590","275565651061572717164448838929036718639","55613574499963336691833296656328405189","140306171330172642737935933420349011761","107067623523191167839773677396193517203"]},"id":"CVE-2026-108263-43363f5e","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java"}},{"deprecated":false,"digest":{"function_hash":"21804220314210258607915181312372938221","length":274},"id":"CVE-2026-108263-48013167","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkBlackListAllowsWhitelistedRedirectTarget"}},{"source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"ensurePublicAddresses","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java"},"deprecated":false,"digest":{"function_hash":"268111900866793958033659307633333114827","length":352},"id":"CVE-2026-108263-486179fe","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"getRedirectUrl","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java"},"deprecated":false,"digest":{"function_hash":"275538738402395520555972233416474381367","length":95},"id":"CVE-2026-108263-4d7c0b87"},{"source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","function":"toSafeHttpUrl"},"deprecated":false,"digest":{"function_hash":"223419422786601128480438896203476309926","length":850},"id":"CVE-2026-108263-6a80fd87","signature_type":"Function","signature_version":"v1"},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","function":"lookupRedirect"},"deprecated":false,"digest":{"function_hash":"303866164510011079743862219365658922973","length":632},"id":"CVE-2026-108263-6eecb8eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"id":"CVE-2026-108263-7142a0a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"getRedirectUrl"},"deprecated":false,"digest":{"length":96,"function_hash":"297766944416984997966694016966562100067"}},{"signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java"},"deprecated":false,"digest":{"line_hashes":["263860677902033418556854429194812693254","333328150934530565641208976458353306188","140127397475482839019419516749058429697","305998154201665588088018120461128246755","245653901403368276794789855587035346814","154465915885485808395779245474741623297","262463231016961955469262061657308497036","47706522953021745609071486445367671650","6946641838772250710736672081112829466","246226040174022903033122648735910758102","191818115704931124277171629394960401080","267767980567191716142057334378382859213","212484849383352555558065292055159053236","184915155752502978961628906330477513270","54765729035434101038338977086526314084","274489476595563719410700317055583015287","165685608299728158309924610174248420668","292405002284973995943842284680004620527","212138697708252983388890440790476905202","84584118647689073807003881733315636265","140678207888642018494419696449151173083","181405523200070901375903376395587055016","213001126812746323685566167220660044405","262171634214544499639063424554679119248","311392454018195333658013883017191730145","60457831720865592665257505060354522981","74423578482917503914115069158025703691","197772845217049797778237173860304429720","188023328340978752977653906732307700012","45705853919216673892371832943121644174","50745507467675193553294013719116829782","48126738279961041076941247777749618518","193849083971345432231760190190082833734","338567888403108130228938063374949154338","133013864035642210876712629375722729228","14803668993613333750245094804473233945","33340652384364267564177454168631547902","128959664127868637998122464057179831001","9900276258974029383827144518480019884","69807771830988434628013299911167733960","71798994926118378882096218062523210376","269835777029925737057360912691514983335","220171381559981136866510233664146183008","143053449804516189368240779102524661854","78405177279960497400851777327805972824","160260748600303348913952661172292105751","69193165297295745780312360143926186058","12118618285486808566696572985251759349","314973288280277090856784145405285307251","336842694077807125722172227377545150182","9660540981284067006852208537491994169","329678151032953781115079689578775509265","294926345079985354426762015237965527878","105916010239476077331362676278524433696","59679650507663492047441470983716087769","7990841722038558893796818854825235483","84831254669322465853488781654582825976","214054025674958423181547786569081151185","187224478904160716661176928403794398635","132573215611839715800860228573076544903","124763034123191122393420564149772317784","134247417877048554738268633356559900679","18287965731940699644579828143460036975","38301674476398343121398830091954688648","65640200248599756457036863795718116118","241901632021333978663895598457099635829","69915431165031773644215810323204939323","100457837894696667177911920213190444612","246146295814862579996902317955711306569","130295460390391519080798679838539579220","113952984411961075456264848629144075885","74888321291585593021147604614204153641","137257209754885198734073903139699682165","177171659783790076948128831848233444417","232174714242325257918827978210391841327","304783664945222192737515416461902684788","231852748440304365651479884418583884386","325761864685919868398698312789069637375","268786227985599740231293501845104934795","294043371898342042165944045786360482765","196058572909215199685135143066334551338","320864965875524198016701901053335100465","308474953922350526742731190131666982190","83293885171208068613860631255184859635","34344569988499996922496377021689466864","295833350329999280972660501818934582703","118537745041958039160804103255492361027","13253527788762076848241971780135767682","203110925987515719593765009239690312912","47823658378169421411715780787327290997","3215882124486469798827223690294080298","129118024980574585429415356701108456166","306665369929393621782552592769766577381","86379700407110398620521759464657076347","159903854514344966012164443186666660894","142273427504564734376236607558870468915","277663852437001710649573580124799521346","210963435430946954244018332253402706563","239291391485025110904813975053116647430","308519479230361787330516203095702938174","179355192829392631475010841309021400569","186011953557269996002364741263472141793","109483554940872518957952992721195473691","271507752126122747826655980075102660380","143989127279464919172262889993271631396","338008409874925934417561327447380534601","125482329022957514383578798921009830314","155832567951998353007923790221638860299","19560453296227173561131706634256343938","115606733614231336174553667679798318243","102773042227712380051185624212894701760","193945555105656936453847297800470789796","63726031760042910161267119482571320237","321653962758831727714199127112185504440","248330914536884339228756763260008069933","81827248424283200364458520663716226632","21174487403283644896780796543649593328","37734627636560671549846619323047823050","272528562135222510337154107862913823298","242244596914750938247342404387186870057","118044608909800480775136012825459030892","269952751366592154579274645430434821763","4747899086846387166811411305799075336","106531076174522775130188439032945680739","106953895770216293800919142819581509565","78908914452975977528396121161132650999","166412856449123015810150027549615840158","235534376604469642762838761370020327340","138694288270911970590533062806488315491","235627931733690294982939088013258487591","192234659305085368215493853560810177758","214119543651835327535071750445603668560","282148136468573291582848155188504981923","114032053347443507204444196407255506823","285153623288615424554684487863511026283","90855974941058449301781897327878242851","151599960251098126888702695766446492752","189720023174198051225276002072950463021","148085761535225019602307401501954094328","166037665346956182651059266842197620439","45453829554289958593457432164095410234","233112983613933244229505632815017338898","218856526465154331651927133924719123847","36633759448003369931397068477492358044","42538362013588173681397850091656078370","7893423290564013452112790898715094505","197111086195369700993155903489517771198","156361199719280479078639886472524706982","126564546424653427991389045574167349073","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-108263-9d75aba6","signature_type":"Line"},{"id":"CVE-2026-108263-a286194b","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"isHostInDomainAllowList","file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java"},"deprecated":false,"digest":{"length":563,"function_hash":"251080973521426746743319972162329277854"}},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","function":"getRedirectUrl"},"deprecated":false,"digest":{"function_hash":"186533484752399872693523034402703218080","length":453},"id":"CVE-2026-108263-b3d99e54","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","function":"validateUrlAgainstBlacklist"},"deprecated":false,"digest":{"function_hash":"114111597420802382078254871654069219568","length":1220},"id":"CVE-2026-108263-c2038ede","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxService.java"},"deprecated":false,"digest":{"line_hashes":["287353381538297416521610701614398806494","229397462787117330021186394621938802936","196348343818220984012116493838734904348","274974913873302323687159305998652784704","190575059779426393250662059047423440429"],"threshold":0.9},"id":"CVE-2026-108263-c22eaf88","signature_type":"Line","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxServiceDebugToolTest.java","function":"debugToolV2_allowsTrustedOfficialInternalEndpoint"},"deprecated":false,"digest":{"function_hash":"23108364897377676709129150778518340300","length":1163},"id":"CVE-2026-108263-c5ebf902","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/tool/UrlCheckTool.java","function":"checkBlackList"},"deprecated":false,"digest":{"function_hash":"141339482547282822953556434350844636410","length":818},"id":"CVE-2026-108263-d1d2d485","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-108263-d3aa4290","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkUrlRejectsRedirectToNonHttpProtocol"},"deprecated":false,"digest":{"function_hash":"251387655920364559644350374429283050065","length":575}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkBlackListRejectsBlacklistedTargetAfterMultipleRedirects"},"deprecated":false,"digest":{"function_hash":"218683846556497519188560801707052149512","length":338},"id":"CVE-2026-108263-d7172bc0"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkBlackListRejectsRedirectTargetOutsideWhitelist"},"deprecated":false,"digest":{"function_hash":"233180121041078818150235175050098345379","length":294},"id":"CVE-2026-108263-db3231cd"},{"target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"toSafeHttpUrlPreservesEncodedPathAndQuery"},"deprecated":false,"digest":{"length":364,"function_hash":"243994178836043636527876940537448206698"},"id":"CVE-2026-108263-e189494f","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/tool/ToolBoxServiceDebugToolTest.java"},"deprecated":false,"digest":{"line_hashes":["300149218608517874042831748984512192708","10337731800778357204368488913355757462","139408587386707792975183362803820465699","211604965228204844015346952538685311860","281860928930852196879614285514091185638","315990338630688082551395671320401065189","195464691101337472011905773264125325009","330127974028456938409563771413463269135","290688901360512166105522259329505161643","209475435227081942716218996000880731336"],"threshold":0.9},"id":"CVE-2026-108263-ee403b97","signature_type":"Line","signature_version":"v1"},{"target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkUrlAllowsIpInWhitelist"},"deprecated":false,"digest":{"function_hash":"249295651362983837494465859941293749502","length":487},"id":"CVE-2026-108263-eec682ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10"},{"id":"CVE-2026-108263-f9aa2e4a","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"function":"checkBlackListRejectsTemporaryRedirectToBlacklistedIp","file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java"},"deprecated":false,"digest":{"length":612,"function_hash":"221988270346357201319211781147501899958"}},{"digest":{"function_hash":"42750807705315322396678591820562307196","length":257},"id":"CVE-2026-108263-fa29e496","signature_type":"Function","signature_version":"v1","source":"https://github.com/iflytek/astron-agent/commit/189600dd691e8562bd0b9f7112727b107b8a2e10","target":{"file":"console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/tool/UrlCheckToolTest.java","function":"checkUrlRejectsRedirectWithUserInfo"},"deprecated":false}],"vanir_signatures_modified":"2026-10-11T07:04:28Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108263.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}