{"id":"CVE-2026-108160","published":"2026-10-09T17:16:47.180","lastModified":"2026-10-09T20:17:10.767","description":"AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-494"],"vendors":[],"products":[],"references":[{"url":"https://github.com/iflytek/astron-rpa","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electron-app/electron-builder.json#L26","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/issues/894","tags":[]},{"url":"https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-unsigned-update-installation-via-plain-http-feed","tags":[]}],"exploitRefs":[{"url":"https://github.com/iflytek/astron-rpa","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electron-app/electron-builder.json#L26","tags":[]},{"url":"https://github.com/iflytek/astron-rpa/issues/894","tags":[]}],"hasPoc":true,"ai":{"summary":"AstronRPA's auto-update mechanism fails to verify the integrity of downloaded updates, allowing attackers to inject malicious code into the desktop client. This vulnerability can lead to arbitrary code execution as the desktop user.","exploitability":"Exploitation requires an attacker positioned between the client and update server (man-in-the-middle) with access to serve malicious update manifests and installers, making it moderately difficult but possible with network interception capabilities.","blast_radius":"If exploited, this vulnerability could compromise all systems running AstronRPA 1.1.6 or earlier, potentially leading to full system compromise as the desktop user with access to local resources and applications.","remediation":"Upgrade to version 1.1.7 or later to receive the integrity verification fix for the auto-update mechanism.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","update","mitm"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:00:51.062Z"}}