CVE-2025-51387

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada axosoft gitkraken desktop. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.

Rincian

Terbit di NVD

4 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.electronjs.org/blog/statement-run-as-node-cves#mitigation mitigasi
• https://github.com/r3ggi/electroniz3r not applicable
• https://packetstorm.news/files/id/207677 broken link