The vulnerability allows an attacker to download code without an integrity check, enabling malicious update files to be executed as the desktop user. It relies on the Electron auto‑update mechanism which accepts unsigned files, creating a path for an attacker to run arbitrary code on the host. The weakness is a classic download of code without integrity verification (CWE‑494).

Affected systems include the AstronRPA desktop automation platform developed by iFlytek. Versions up to and including 1.1.6 are vulnerable. The issue arises in the electron‑updater component that downloads update packages from a plain‑HTTP feed without verifying their integrity.

The CVSS score of 7.7 indicates high severity, while no EPSS score is publicly available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can position themselves between the client and the update server, serving a crafted update manifest and NSIS installer. Because the electron‑updater accepts unsigned files without verifying signatures, the malicious payload is installed and executed with the rights of the desktop user, leading to arbitrary code execution. The exploitation path therefore hinges on network proximity or compromise of the update feed service, but once achieved, it grants full system control.