CVE-2026-108160

Summary

AstronRPA's auto-update mechanism fails to verify the integrity of downloaded updates, allowing attackers to inject malicious code into the desktop client. This vulnerability can lead to arbitrary code execution as the desktop user.

Exploitability

Exploitation requires an attacker positioned between the client and update server (man-in-the-middle) with access to serve malicious update manifests and installers, making it moderately difficult but possible with network interception capabilities.

Blast radius

If exploited, this vulnerability could compromise all systems running AstronRPA 1.1.6 or earlier, potentially leading to full system compromise as the desktop user with access to local resources and applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.7 or later to receive the integrity verification fix for the auto-update mechanism.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.