{"uuid": "858062fc-3811-41f4-9597-48c9922b636d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108160", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117411908963692005", "content": "CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108160https://github.com/iflytek/astron-rpa/issues/894https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electron-app/electron-builder.json#L26https://github.com/iflytek/astron-rpahttps://www.vulncheck.com/advisories/astronrpa-through-1.1.6-unsigned-update-installation-via-plain-http-feed#iflytek #astron-rpa#CVE_2026_108160#bot", "creation_timestamp": "2026-10-09T16:32:32.857240Z"}