Critical · published August 4, 2025
🚨 Code injection is lurking in GitKraken Desktop versions 10.8.0 and 11.1.0. With just a sneaky configuration error, attackers can execute malicious code! 🔥 Think of it like a restaurant where the chefs can cook whatever they want without checks — one misstep on the menu allows anyone to whip up a secret recipe, and in this case, that recipe could be harmful! An attacker could exploit this vulnerability to run arbitrary code on your system, potentially leading to a complete takeover of the application. This could mean unauthorized access to sensitive data, manipulation of project files, or even installing malware — absolutely devastating!
Think of it like a restaurant where the chefs can cook whatever they want without checks — one misstep on the menu allows anyone to whip up a secret recipe, and in this case, that recipe could be harmful! This vulnerability arises from misconfigured Electron Fuses in GitKraken that enable Node.js mode. The unsafe settings allow attackers to pass in malicious arguments, paving the way for arbitrary code execution.
An attacker could exploit this vulnerability to run arbitrary code on your system, potentially leading to a complete takeover of the application. This could mean unauthorized access to sensitive data, manipulation of project files, or even installing malware — absolutely devastating! Immediately upgrade GitKraken to the latest version beyond 11.1.0 to eliminate this risk. Ensure that settings like RunAsNode are disabled and always maintain secure configurations. Regularly review your application settings to stay ahead of vulnerabilities! You've got this! Follow these steps, and you'll be well on your way to securing your GitKraken environment! 🛡️