CVE-2026-108159

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...

CVE-2026-108160

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...

CVE-2026-108160

The AstronRPA desktop client (versions through 1.1.6 ) is vulnerable to a download of code without integrity check (CWE-494). The electron-updater component fails to perform signature verification when fetching updates via a plain-HTTP feed . A network attacker positioned between the client and t...

CVE-2026-108159

AstronRPA versions through 1.1.6 are vulnerable to Remote Code Execution (RCE) due to a cross-site scripting (XSS) flaw in the desktop client's smart-component chat . The root cause is the rendering of unsanitized LLM output via v-html . An attacker can use prompt-injection on a webpage to force ...