CVE-2026-108160: AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the AstronRPA desktop client through version 1.1.6 are exposed when its auto-update mechanism retrieves updates over the network and an attacker can position themselves between the client and update server.
What does an attacker need to exploit it?
The attacker must be able to intercept or manipulate the network path between the desktop client and the update server. Exploitation also requires the user to interact with the update process, as reflected by the UI:R vector.
What is the impact if exploitation succeeds?
An attacker can supply a malicious update manifest and NSIS installer. The installer is installed without signature verification and can execute code with the privileges of the desktop user.
What can be done if patching is not immediately possible?
The provided information identifies the auto-update mechanism and its plain-HTTP feed as the exposure point. Preventing untrusted network parties from intercepting or modifying traffic between clients and the update service reduces the opportunity for exploitation.