VulnerabilityAnalyzed

CVE-2025-51387

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.

CRITICAL 9.8EPSS 0.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.55% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: axosoft/gitkraken desktop
Source: cve@mitre.org

References

https://github.com/r3ggi/electroniz3rNot Applicable
https://packetstorm.news/files/id/207677Broken Link
https://www.electronjs.org/blog/statement-run-as-node-cves#mitigationMitigation

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.