Threats tagged 'ghsa-mj3v-h93p-hj6p'

AstronRPA versions up to 1.1.6 have a vulnerability where the desktop client downloads code updates without verifying their integrity. This allows a network attacker positioned between the client and update server to deliver malicious update manifests and installers, which are installed without signature checks, leading to code execution with the desktop user's privileges.