Cross-Site Scripting Vulnerability in AstronRPA Desktop Client

CVE-2026-108159

What is CVE-2026-108159?

AstronRPA, as of version 1.1.6, contains a cross-site scripting vulnerability within its desktop client. This flaw is present in the smart-component chat feature, enabling remote attackers to execute operating system commands. The vulnerability arises from unsanitized output from a large language model (LLM) that is rendered using v-html. Attackers can exploit this issue by injecting prompt-injection content into a web page, prompting the model to emit HTML event handlers. These handlers, when combined with shell metacharacters, invoke the unrestricted open-path IPC handler, allowing command execution under the context of the desktop user.

References