CVEvulnerability
CVE-2026-86185
8.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-09-05
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-295
Description
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://app.bilibili.com/ app.bilibili.com
- https://github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce github.com
- https://github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce/blob/main/advisory.md github.com
- https://www.vulncheck.com/advisories/bilibili-desktop-through-1.18.0-remote-code-execution-via-tls-verification-bypass www.vulncheck.com