{"id":"CVE-2026-108159","published":"2026-10-09T17:16:47.027","lastModified":"2026-10-13T17:17:19.517","description":"AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/iflytek/astron-rpa","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/web-app/src/components/SmartComponent/hooks/useChatContext.tsx#L203","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/issues/892","tags":[]},{"url":"https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-rce-via-smart-component-chat-xss-and-ipc-bridge","tags":[]}],"exploitRefs":[{"url":"https://github.com/iflytek/astron-rpa","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/web-app/src/components/SmartComponent/hooks/useChatContext.tsx#L203","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/issues/892","tags":[]}],"hasPoc":true,"ai":{"summary":"AstronRPA's desktop client contains a cross-site scripting vulnerability in its smart-component chat that allows remote attackers to execute OS commands by injecting malicious HTML into LLM responses. This occurs when unsanitized LLM output is rendered via v-html, enabling attackers to abuse IPC handlers with shell metacharacters.","exploitability":"Exploitation requires a victim to visit a malicious web page containing prompt-injection content that tricks the LLM into generating HTML event handlers, making it moderately difficult but possible with user interaction.","blast_radius":"If exploited, attackers could execute arbitrary OS commands as the desktop user, potentially leading to full system compromise, data exfiltration, or lateral movement within the local network.","remediation":"Upgrade to version 1.1.7 or later to address this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","rce","web","llm"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:00:58.595Z"}}