CVE-2026-108160highCWE-494

CVE-2026-108160: falha de alta gravidade em iflytek astron-rpa

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

Publicada em

Seguir esta CVE+ Monitorar astron-rpa

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.1%
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
iflytek · astron-rpa
CVEs relacionadas — iflytek astron-rpa

No mesmo produto, das mais perigosas para as menos.

CVE-2026-108159HIGHAstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC BridgeEPSS 0.3%CVE-2026-108548MEDIUMAstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer TokenEPSS 0.3%CVE-2026-108547HIGHAstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-varEPSS 0.2%CVE-2026-110764MEDIUMAstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/downloadEPSS 0.2%