7.5Yüksek
CVE-2026-108160AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
Açıklama
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
Zayıflık türü (CWE):
CWE-494
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| iflytek | astron-rpa | ≤ 1.1.6 |
Kaynaklar ve yamalar
- GitHub Issue #894 issue-tracking
- https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electro… technical-description
- https://github.com/iflytek/astron-rpa product
- VulnCheck Advisory: AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed third-party-advisory