PT-2025-31865 · Unknown · Gitkraken Desktop

Published 2025-08-04 · Updated 2025-10-09 · CVE-2025-51387

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitKraken Desktop versions 10.8.0 and 11.1.0

Description GitKraken Desktop is susceptible to code injection due to misconfigured Electron Fuses. Insecure settings, specifically RunAsNode being enabled and EnableNodeCliInspectArguments not being disabled, allow the application to be executed in Node.js mode. This enables attackers to pass arguments that result in arbitrary code execution.

Recommendations GitKraken Desktop version 10.8.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. GitKraken Desktop version 11.1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-51387

Affected Products

Gitkraken Desktop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-51387 · Security Note
• https://osv.dev/vulnerability/CVE-2025-51387 · Vendor Advisory
• https://github.com/r3ggi/electroniz3r · Note
• https://t.me/CVEtracker/29129 · Telegram Post
• https://twitter.com/CVEnew/status/1952478834747449683 · Twitter Post
• https://electronjs.org/blog/statement-run-as-node-cves#mitigation · Note
• https://t.me/cveNotify/138026 · Telegram Post
• https://packetstorm.news/files/id/207677 · Note