CVE-2026-108159 in AstronRPA
Summary
by MITRE • 10/09/2026
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in AstronRPA versions through 1.1.6 represents a critical intersection of prompt injection and client-side code execution flaws within its desktop application architecture. The core technical flaw resides in how the smart-component chat interface processes output generated by integrated Large Language Models. Specifically, the application utilizes Vue.js's v-html directive to render LLM responses directly into the DOM without adequate sanitization or context-aware filtering. This design choice assumes that text content from an AI model is inherently safe for direct HTML rendering, which fails to account for adversarial inputs designed to manipulate the model’s output generation process.
The attack vector begins with a remote attacker embedding malicious prompt-injection payloads within accessible web pages or documents viewed by the target user via the AstronRPA client. When the integrated LLM processes these injected prompts, it may be coerced into emitting specific HTML event handlers rather than plain text. Because the application renders this output using v-html, the browser interprets and executes the embedded JavaScript code immediately upon rendering. This mechanism bypasses standard content security policies that might otherwise restrict script execution in certain contexts, effectively turning a conversational interface into an arbitrary code execution engine.
The operational impact of this vulnerability is severe due to its ability to escalate from cross-site scripting to operating system command execution. The executed client-side scripts interact with the desktop application’s internal inter-process communication (IPC) handlers. In this specific instance, the attacker exploits an unrestricted open-path IPC handler that accepts file paths or commands without sufficient validation. By injecting shell metacharacters within the payload sent through this channel, the remote attacker can trigger arbitrary command execution on the host machine with the privileges of the currently logged-in desktop user. This transforms a typical web-based vulnerability into a full system compromise scenario where an adversary gains persistent access to sensitive data and local resources.
From a classification perspective, this flaw aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting, specifically in the context of server-side or client-side template injection variants. Furthermore, it relates to CWE-20 Improper Input Validation regarding the IPC handler’s failure to sanitize shell metacharacters. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Client-Side Scripting and potentially Command and Control if used for beaconing or data exfiltration from the compromised endpoint. The use of prompt injection also highlights emerging risks in AI-integrated software where model outputs are treated as trusted input by downstream application components.
Mitigation strategies must address both the rendering mechanism and the IPC communication layer immediately. Developers should replace direct v-html usage with safer alternatives such as text interpolation or strict HTML sanitization libraries that strip out event handlers, scripts, and dangerous attributes before DOM insertion. Additionally, the open-path IPC handler requires rigorous input validation to ensure that only expected file paths are accepted, effectively neutralizing shell metacharacter injection attempts. Implementing a Content Security Policy with restrictive script-src directives can further limit the impact of any residual XSS vectors by preventing inline script execution. Until patches are applied, users should be advised to avoid interacting with untrusted content within the smart-component chat feature and to restrict application permissions where possible to minimize potential damage from successful exploitation attempts.