What happened
The DDL whitelist handler in iFlytek astron-agent uses an incomplete blacklist that can be circumvented by comment smuggling, letting a remote caller run unintended DDL against the agent's knowledge/memory database. NVD (vulndb CNA) gives CVSS 7.3 with a public PoC and CISA SSVC marks it exploitable/automatable; published 2026-10-26.
Why it matters
astron-agent is an agent framework whose memory/knowledge store is queried by LLM-driven workflows; a DDL whitelist bypass allows an attacker or a prompt-injected agent to modify or corrupt the persistence layer (and potentially issue further commands), affecting the agent's stored context and any downstream decisions.
Attack vector
An unauthenticated remote caller submits DDL to the agent's memory/database exec_ddl endpoint; the incomplete blacklist is bypassed via comment/whitespace smuggling, so attacker-chosen SQL/DDL is executed against the agent's memory database. A public PoC is released and the vendor did not respond.
Affected systems
iFlytek astron-agent up to 1.1.2 (DDL Whitelist Handler).
Mitigation
No fixed version available (vendor non-responsive). Restrict access to the exec_ddl endpoint, disable it if unused, and validate/normalize DDL against an allowlist rather than a blacklist.