{"vulnerability": "CVE-2026-108160", "sightings": [{"uuid": "858062fc-3811-41f4-9597-48c9922b636d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108160", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117411908963692005", "content": "CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108160https://github.com/iflytek/astron-rpa/issues/894https://github.com/iflytek/astron-rpa/blob/8b015bc1b15d23fbdc55c78ff1de9af4bb65fba6/frontend/packages/electron-app/electron-builder.json#L26https://github.com/iflytek/astron-rpahttps://www.vulncheck.com/advisories/astronrpa-through-1.1.6-unsigned-update-installation-via-plain-http-feed#iflytek #astron-rpa#CVE_2026_108160#bot", "creation_timestamp": "2026-10-09T16:32:32.857240Z"}, {"uuid": "70e2a1c4-7145-4dda-b4fe-88223875ab7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108160", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxhivcots72s", "content": "\ud83d\udfe0 CVE-2026-108160 - High (7.5)\n\nAstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that al...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108160/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-09T17:31:07.488700Z"}, {"uuid": "77fc706c-a9b1-4490-b756-d1363ab73765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108160", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mximlu6abw2z", "content": "CVE-2026-108160 - astron-rpa\nIf an attacker can see the network traffic between the AstronRPA desktop client and its update server, they can send a crafted update that the client accepts without checking\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#astronrpa #iflytek #CVE #infosec", "creation_timestamp": "2026-10-10T04:10:06.951139Z"}]}