AstronRPA EUVD-2026-95907

Requires that the victim actively use the smart-component chat feature of the AstronRPA desktop client (≤1.1.6) and have the integrated LLM process attacker-controlled content (prompt injection from a crafted web page); the client must render the model's output through v-html without sanitization, and the unrestricted open-path IPC handler must be reachable to pass shell metacharacters. Limiting factors that reduce realistic risk: passive user interaction is needed (UI:P), the attack depends on reliably coercing non-deterministic LLM output (AC:H/AT:P), and it is bounded to the privileges of the logged-in desktop user. No authentication is required (PR:N).

This is a genuine remote-code-execution path (RCE via XSS → IPC bridge) carrying a CVSS 4.0 base score of 7.7 (High) with VC:H/VI:H/VA:H, reflecting full compromise of the desktop user's context. However, the real-world risk is materially lower than the 'RCE' label suggests because of the exploitation preconditions encoded in the vector: AC:H (high attack complexity), AT:P (a present attack requirement), and UI:P (passive user interaction). Exploitation hinges on reliably steering a non-deterministic LLM via prompt injection to emit a specific malicious v-html event handler, which is inherently unreliable. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced - only a GitHub issue (#892), the specific vulnerable source line in useChatContext.tsx, and a VulnCheck advisory. Signals are internally consistent (PR:N unauthenticated network vector matches a web-page-delivered attack), with no contradictions between the vector and description. Net: a credible but conditional High, not a drop-everything emergency - prioritize patching but weigh the low confidence of reliable exploitation and the niche footprint of the product.

An attacker publishes a web page containing hidden prompt-injection text. A victim running the AstronRPA desktop client uses the smart-component chat to summarize or interact with that page; the LLM is coerced into emitting HTML with an event handler that the client renders unsanitized via v-html, which invokes the unrestricted open-path IPC handler carrying shell metacharacters, executing OS commands as the desktop user. No public exploit code is referenced, and reliability is limited by the non-deterministic LLM output (AC:H/AT:P) and required user interaction (UI:P).