AstronRPA CVE-2026-108160

Requires the attacker to hold an on-path / man-in-the-middle position between the AstronRPA desktop client and its update server, because the auto-update feed is retrieved over plaintext HTTP with no transport encryption, and electron-updater is configured (per the public electron-builder.json) to install the NSIS installer without signature verification. Exploitation also depends on the client performing an update check that the attacker can intercept (the UI:P / passive user-interaction factor). Limiting factors: the MITM prerequisite (local network, rogue AP, compromised gateway, or on-path upstream) is non-trivial and corresponds to the vendor's AC:H and AT:P ratings, so this is not a scalable remote drive-by; it is confined to the AstronRPA desktop client at versions through 1.1.6 on networks the attacker can position within.

Signals point to a genuine but conditional threat rather than a mass-exploitation emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, score 7.7 High) is internally consistent with the description: unauthenticated (PR:N) network attacker, but with meaningful friction - high attack complexity (AC:H), a present attack requirement (AT:P, i.e. the attacker must be on-path at update time), and passive user interaction (UI:P) to trigger the auto-update check. Impact is full code execution as the desktop user (VC:H/VI:H/VA:H), confirming high technical impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation probability signals are entirely absent rather than low - do NOT read the missing EPSS as evidence of low risk. SSVC inputs were not provided. The practical gating factor is the man-in-the-middle precondition plus plaintext-HTTP update feed; this is not automatable at internet scale and favors targeted or local-network adversaries (rogue Wi-Fi, compromised router, on-path ISP/enterprise segment) over worm-like spread. Net: treat as a real supply-chain/update-integrity priority for environments running the AstronRPA desktop client on untrusted networks, but it is not a remotely-wormable drive-by.

An attacker on the same network as a victim (e.g., a malicious Wi-Fi hotspot or compromised router) intercepts the AstronRPA desktop client's plaintext-HTTP update check and returns a crafted update manifest pointing to a malicious NSIS installer. Because electron-updater is configured without signature verification, the client downloads and runs the attacker's installer, executing arbitrary code in the user's context. No public exploit was identified at time of analysis, but the flaw is a well-understood electron-updater misconfiguration class and the vulnerable config is visible in the project's public electron-builder.json.