CVE-2025-51387

CVSS 9.8 CRITICALEPSS 0.5%CWE-94

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

04 ago 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

n/a · n/a

Referencias

https://github.com/r3ggi/electroniz3r https://packetstorm.news/files/id/207677 https://www.electronjs.org/blog/statement-run-as-node-cves#mitigation