HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-108159 — AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des...

·Source: NIST NVD

Updated:

Executive Summary

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu

Analysis

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user. CVSS Score: 7.5. Published: 2026-10-09T17:16:47.027.

Indicators of Compromise (1)

CVE (1)
CVE-2026-108159
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 9, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

Millions of Exploit Attempts Logged Against PHP Servers

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/millions-exploit-attempts-logged-against-php-servers-image_small-6-a-33179.jpg" align=right hspace=4><b>Urgent PHP Patching Advised as Experts See Widespread Exploit-Building Attempts</b><br>Attacks targeting the critical PHP vulnerabilities dubbed PHP2Shell and patched Wednesday are continuing to mount as hundreds of proof-of-con

Bank Info Security
MEDIUMVulnerability

How bug bounty sharpens one researcher’s security skills

As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers. The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog .

GitHub Security Blog
MEDIUMVulnerability

The Current Landscape of OAuth Attacks

Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .

Unit 42 (Palo Alto)