AstronRPA: text on a web page makes the AI chat run commands
CVE-2026-108159 turns prompt injection in AstronRPA's chat panel into operating system commands run as the desktop user.
· VulnCheck · Research by George Chen
CVE-2026-108159 is a code execution chain in iFlytek's AstronRPA desktop client: injected text on a web page makes the model return HTML that calls an unrestricted IPC handler with shell metacharacters. No fixed version is listed.
01What happened
VulnCheck published the advisory for CVE-2026-108159 on October 9, 2026, covering iFlytek's AstronRPA through version 1.1.6, and credits George Chen with the discovery. A public issue in the astron-rpa repository describes the same chain and is still open, with no maintainer reply shown.
02How it works
AstronRPA's desktop client renders streamed model output as raw HTML through Vue's v-html directive, without sanitizing it. An attacker plants prompt injection text in a web page the model reads, and the model then returns HTML carrying event handlers. Those handlers reach the client's open-path IPC handler, which is unrestricted and builds a shell command from the path it is given, so shell metacharacters execute as the desktop user.
03Who is affected
AstronRPA 1.1.6 and earlier are affected, in the desktop client's smart-component chat. Exposure needs the model to read attacker-controlled content during a chat, so the risk sits with teams that let AstronRPA reach untrusted pages.
04What to do
Keep AstronRPA's chat away from untrusted web content, because the advisory lists no patched version. The repository issue names the two places to check in a local build: raw HTML rendering in the chat panel, and the generic IPC bridge that exposes the open-path and read-file handlers.
Sources 3 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2github.comGitHub Advisory
- 3github.comRepository Issue