CVE-2026-108159

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...

CVE-2026-108159

AstronRPA versions through 1.1.6 are vulnerable to Remote Code Execution (RCE) due to a cross-site scripting (XSS) flaw in the desktop client's smart-component chat . The root cause is the rendering of unsanitized LLM output via v-html . An attacker can use prompt-injection on a webpage to force ...

EUVD-2026-95907

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emi...