# AstronRPA: text on a web page makes the AI chat run commands

> CVE-2026-108159 turns prompt injection in AstronRPA's chat panel into operating system commands run as the desktop user.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-09
- **CVE:** CVE-2026-108159
- **CVSS:** 7.7
- **Affects:** AstronRPA
- **Research by:** George Chen
- **Primary source:** https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-rce-via-smart-component-chat-xss-and-ipc-bridge
- **Page:** https://theinjection.dev/items/astronrpa-smart-chat-ipc-rce/

CVE-2026-108159 is a code execution chain in iFlytek's AstronRPA desktop client: injected text on a web page makes the model return HTML that calls an unrestricted IPC handler with shell metacharacters. No fixed version is listed.

## What happened

VulnCheck published the advisory for CVE-2026-108159 on October 9, 2026, covering iFlytek's AstronRPA through version 1.1.6, and credits George Chen with the discovery. A public issue in the astron-rpa repository describes the same chain and is still open, with no maintainer reply shown.

## How it works

AstronRPA's desktop client renders streamed model output as raw HTML through Vue's v-html directive, without sanitizing it. An attacker plants prompt injection text in a web page the model reads, and the model then returns HTML carrying event handlers. Those handlers reach the client's open-path IPC handler, which is unrestricted and builds a shell command from the path it is given, so shell metacharacters execute as the desktop user.

## Who is affected

AstronRPA 1.1.6 and earlier are affected, in the desktop client's smart-component chat. Exposure needs the model to read attacker-controlled content during a chat, so the risk sits with teams that let AstronRPA reach untrusted pages.

## What to do

Keep AstronRPA's chat away from untrusted web content, because the advisory lists no patched version. The repository issue names the two places to check in a local build: raw HTML rendering in the chat panel, and the generic IPC bridge that exposes the open-path and read-file handlers.

## Quick facts

- **Affected:** AstronRPA 1.1.6 and earlier
- **Fixed in:** No patched version listed; repository issue 892 remains open
- **CVE:** CVE-2026-108159, published October 9, 2026
- **CVSS v4:** 7.7 high, scored by VulnCheck
- **Found by:** George Chen
- **Attack type:** Prompt injection to unsanitized HTML to Electron IPC command execution

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-rce-via-smart-component-chat-xss-and-ipc-bridge)
2. [GitHub Advisory](https://github.com/advisories/GHSA-gwjf-3fv9-8jxc)
3. [Repository Issue](https://github.com/iflytek/astron-rpa/issues/892)