CVE-2026-108160: Download of Code Without Integrity Check in iflytek astron-rpa

CVE-2026-108160 affects iflytek's AstronRPA through version 1.1.6. The vulnerability arises because the electron-updater component used by the desktop client does not verify the signature of downloaded update manifests and NSIS installers. An attacker positioned between the client and update server can intercept and replace legitimate update files with malicious ones. Since the client installs these updates without integrity checks, the attacker can execute arbitrary code as the desktop user.

Successful exploitation allows a network attacker with the ability to intercept client-server communication to execute arbitrary code on the victim's machine with the same privileges as the desktop user. This can lead to compromise of the user's environment and potentially further system compromise depending on user privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted networks or ensure secure channels (e.g., VPN) to prevent interception of update traffic. Monitoring vendor communications for an official fix is recommended.