PT-2026-108979 · Unknown · Astron-Rpa
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AstronRPA versions prior to 1.1.7
Description
The desktop client's auto-update mechanism fails to perform integrity checks on downloaded code. Network attackers positioned between the client and server can deliver a malicious update manifest and NSIS installer. Because the
electron-updater component installs these files without signature verification, it allows for the execution of arbitrary code with the privileges of the desktop user.Recommendations
Update AstronRPA to version 1.1.7 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astron-Rpa