CVE-2026-108159
HighCVSS 7.5Summary
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat. Unsanitized LLM output rendered via v-html allows remote attackers to execute OS commands by embedding prompt-injection content that invokes the unrestricted open-path IPC handler with shell metacharacters.
Risk Assessment
An attacker can execute arbitrary OS commands as the desktop user, leading to full workstation compromise and lateral movement within the organization's network.
Recommendation
Upgrade AstronRPA beyond 1.1.6, disable v-html rendering of LLM output, and restrict the privileges of the open-path IPC handler.
Other vulnerabilities in AstronRPA
See all- CVE-2026-108548High
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
- CVE-2026-108547Medium
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
- CVE-2026-108160High
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
Original NVD description (English source)
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS