Executive brief
Bilibili Desktop, a popular video streaming application for Windows and macOS, disables TLS certificate verification and loads unsigned remote JavaScript configuration files. An attacker positioned on the network path can intercept these configuration downloads, inject malicious code that runs with elevated privileges, and execute arbitrary system commands or harvest user credentials and authentication tokens.
Technical details
The vulnerability stems from two critical misconfigurations: process-wide disabling of TLS certificate verification (CWE-295) and execution of unsigned remote JavaScript configuration (CWE-494 / CWE-94). An attacker on the network path (LAN or compromised upstream network) can perform a man-in-the-middle attack on the application's configuration fetch requests. The injected JavaScript runs in the Electron renderer process with access to the privileged IPC bridge, allowing execution of arbitrary system commands and access to sensitive data like login credentials. The vulnerability requires network-level access but no user interaction or authentication beyond normal application use. Patches are available in later versions.
Affected products
- Bilibili Desktop through 1.18.0
Timeline
- 2026-09-05: disclosed