CVE-2026-108160 Details
Description
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
A vulnerability in AstronRPA versions through 1.1.6 allows network attackers to deliver malicious updates by exploiting the desktop client's auto-update mechanism. The issue arises because the application downloads update manifests and installers without verifying their integrity or signatures. As a result, an attacker positioned between the client and the update server can inject a harmful update that is installed without any security checks, executing code with the same privileges as the desktop user.
Users can manually verify and sign their update packages before deploying them. For developers, ensuring that the 'verifyUpdateCodeSignature' option is set to true in the 'electron-builder' configuration can mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/iflytek/astron-rpa | [email protected] | Vendor |
| https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electron-app/electron-builder.json#L26 | [email protected] | Source CodeVendor |
| https://github.com/iflytek/astron-rpa/issues/894 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-unsigned-update-installation-via-plain-http-feed | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-494 | Download of Code Without Integrity Check | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iflytek AstronRPA | <= 1.1.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |