EUVD-2026-67122
GHSA-2xcp-rw5v-w3jf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web content
-
DeliveryContent loaded in Bilibili Desktop renderer
-
ExploitCall unvalidated bili-bridge.js IPC handler
-
ExecutionBypass origin check to reach privileged API
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets Bilibili Desktop v1.17.9 specifically and requires the app to load or render attacker-controlled web content that can reach the bili-inject.js / bili-bridge.js IPC bridge; the core condition is that the bridge accepts IPC messages without validating their origin. The primary limiting factor is that the victim generally must load/navigate to malicious content within the client (user interaction) - despite the CVSS UI:N claim - so this is not a pure remote server-side exploit against a listening service. No authentication is required (PR:N per the vector), but the version-specific and interaction-dependent nature narrows realistic exploitation. |
| Impact | The signals conflict. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) paints a wormable unauthenticated network RCE, but the EPSS probability is only 0.26% (17th percentile), there is no CISA KEV listing, and no exploit code is independently confirmed - arguing against imminent mass exploitation. More importantly, the UI:N assignment is questionable: an Electron IPC origin-validation flaw generally requires the victim to load or navigate to attacker-controlled web content within the app (e.g., a malicious page, link, or embedded frame), which is user interaction. If UI:R applies, real-world exploitability is meaningfully lower than the raw score implies. Treat this as a genuine RCE class worth patching, but the 9.8/UI:N framing likely overstates drive-by risk - verify the delivery path and whether interaction is required with the vendor/advisory before prioritizing as a critical drop-everything item. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page (or injects content into a resource the app loads) that calls the exposed bili-bridge.js IPC handlers. When the victim opens or is steered to that content inside Bilibili Desktop v1.17.9, the missing origin check lets the page invoke privileged native functions, executing arbitrary code on the victim's machine. Researcher advisories describing the flaw are public, but no confirmed weaponized exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Remote code execution in Bilibili Desktop v1.17.9 (an Electron-based client for the Bilibili video platform) stems from the bili-inject.js and bili-bridge.js components exposing privileged IPC/native functionality to renderer content without validating message origin. Per the published GitHub advisories, attacker-controlled web content loaded or rendered in the app can invoke these bridge APIs to run arbitrary code on the host. Rated CVSS 9.8 by MITRE, but EPSS is low (0.26%, 17th percentile); no public exploit is independently confirmed and it is not in CISA KEV.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so 'No vendor-released patch identified at time of analysis' applies - monitor Bilibili's release channel for a build newer than 1.17.9 and upgrade once published. As compensating controls specific to this Electron IPC flaw: avoid opening untrusted links or content inside the desktop client (use a hardened browser instead), since exploitation hinges on rendering attacker-controlled web content; where feasible, restrict the app's network egress and run it under a least-privilege OS account to limit post-exploitation impact; and organizations that repackage or self-build the client should enforce strict IPC sender/origin validation (verify event.senderFrame origin, disable nodeIntegration, enable contextIsolation) in bili-bridge.js as an interim code-level fix. Trade-offs: link-hygiene controls depend on user behavior and reduce but do not eliminate risk, and egress/privilege restrictions may impair app functionality. Consult the researcher advisories (LeoWSY-hashblue GitHub) for technical specifics.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bilibili Desktop is a Chromium/Electron desktop application. The named files - bili-inject.js (a content-injection/preload script) and bili-bridge.js (an IPC bridge exposing native/main-process capabilities to the renderer) - implement the classic Electron pattern where privileged functions are surfaced to web content. The root cause is CWE-94 (Improper Control of Generation of Code / code injection), and the referenced advisories specifically frame it as an IPC origin-validation weakness: because the bridge does not verify the origin of incoming IPC messages, untrusted web content rendered inside the app can call privileged handlers it should not reach, escalating from JavaScript in a page context to native code execution. The CPE is a useless 'cpe:2.3:a:n/a:n/a' placeholder, so exact affected-product identification comes from the description and advisory text, not the CPE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated, but an IPC origin-validation bypass requires the victim to load malicious web content in the app, so UI:R; native code execution yields full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
Executive ViewAI
Bilibili Desktop v1.17.9 (Electron video client) contains a critical remote code execution flaw that allows arbitrary code execution when users view compromised web pages in the app, with no patch currently available. While real-world exploitation remains unlikely at present (0.3% EPSS), the vulnerability enables complete endpoint compromise and demands immediate user inventory and defensive controls.
No vendor-released patch identified at time of analysis. Restrict Bilibili Desktop to sandboxed or air-gapped environments only; block application execution through endpoint management if feasible; advise users to defer use. Establish weekly monitoring of vendor advisories for patch release notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB