CVE-2026-108160: Iflytek Astron-Rpa

High severity, CVSS 7.5. EPSS: 0.1% chance of exploitation in the next 30 days.

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.

Affected products

• Iflytek Astron-Rpa: up to and including 1.1.6

Published 2026-10-09. Last modified 2026-10-09.