CVE-2026-108160

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

7.7 High

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.15%Unchanged since Oct 10, 2026

What each source reports

CVE List Score used 7.7

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

Record: CVE-2026-108160
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-494
Updated: 2026-11-02

EUVDEUVD-2026-95908 7.7

Record: EUVD-2026-95908
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mj3v-h93p-hj6p 7.7

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that...

Record: GHSA-mj3v-h93p-hj6p
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-494
Updated: 2026-11-02

NVD 7.7

Record: CVE-2026-108160
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-494
Updated: 2026-11-02

OSV 7.7

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

Record: CVE-2026-108160
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-494
Updated: 2026-11-02

Affected products

iflytek astron-rpa

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-108160 is a high vulnerability (CVSS 7.7) in Iflytek Astron-rpa, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. No source names a fixed version.