Defenders should note that this is not a standard client-side XSS; an attacker can embed specifically crafted prompt-injection content within a web page. When the AstronRPA client processes this content, the LLM is coerced into generating malicious HTML event handlers. These handlers exploit an insecure Inter-Process Communication (IPC) interface, allowing the application to execute OS commands with the privileges of the user running the desktop client. This impact is significant because it enables remote attackers to transition from malicious web content to arbitrary code execution on the local machine.

Impact

Successful exploitation allows a remote attacker to execute arbitrary OS commands in the context of the user running the AstronRPA desktop application. This could lead to full system compromise, exfiltration of sensitive local data, or further lateral movement within the environment. All versions up to 1.1.6 are considered vulnerable.

Recommendation

Prioritize the immediate identification of all endpoints running AstronRPA and coordinate with IT operations to restrict access to untrusted web content via the application until a patch is applied.

• Update all instances of AstronRPA to the latest version beyond 1.1.6 as soon as a security update is provided by the vendor.
• Review network logs for outbound connections from the AstronRPA process to unknown or suspicious domains if the environment allows restricting web content access for the tool.
• Monitor for unusual child processes spawned by the AstronRPA binary, such as cmd.exe, powershell.exe, or sh/bash, which are indicative of IPC-based command execution.