CVE-2026-108159: AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must get a user of the desktop client to interact with web content containing prompt-injection material. The injected content must cause the model to produce HTML with event handlers that reach the unrestricted IPC handler and include shell metacharacters.
Does exploitation require prior access or elevated privileges?
No prior privileges are required. However, exploitation requires user interaction and runs commands with the permissions of the desktop user, not necessarily elevated system privileges.
Which releases are affected?
AstronRPA through version 1.1.6 is identified as affected.