Threats tagged 'ghsa-gwjf-3fv9-8jxc'

AstronRPA versions up to 1.1.6 contain a cross-site scripting (XSS) vulnerability in the desktop client's smart-component chat. This flaw allows remote attackers to execute operating system commands by injecting malicious content into the LLM output, which is rendered unsanitized via v-html. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to embed HTML event handlers that invoke an unrestricted IPC handler with shell metacharacters. This results in command execution with the privileges of the desktop user.