CVE-2026-108160
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
Risk Assessment
A man-in-the-middle attacker can remotely execute arbitrary code on user workstations, potentially leading to data theft or system takeover.
Recommendation
Update AstronRPA to a version later than 1.1.6 that verifies update signatures, and consider enforcing encryption and mutual authentication for the update channel.
Other vulnerabilities in AstronRPA
See all- CVE-2026-108548High
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
- CVE-2026-108547Medium
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
- CVE-2026-108159High
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat. Unsanitized LLM output rendered via v-html allows remote attackers to execute OS commands by embedding prompt-injection content that invokes the unrestricted open-path IPC handler with shell metacharacters.
Original NVD description (English source)
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS