Gdevelop
Monthly
Credential leak in the GDevelop desktop app through 5.6.284 allows unauthenticated remote attackers to exfiltrate a victim's gd_resource cloud session cookie by embedding an attacker-controlled resource URL in a crafted project file, which downloadLocalFile() requests with the cookie attached regardless of destination host; this exposes private GDevelop cloud project resources. Exploitation requires the victim to open the malicious project while holding an active GDevelop cloud session, so impact is limited to confidentiality (CVSS 4.0 base 5.3, medium; independent assessment CVSS 3.1 5.3, UI:R). No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Credential leak in the GDevelop desktop app through 5.6.284 allows unauthenticated remote attackers to exfiltrate a victim's gd_resource cloud session cookie by embedding an attacker-controlled resource URL in a crafted project file, which downloadLocalFile() requests with the cookie attached regardless of destination host; this exposes private GDevelop cloud project resources. Exploitation requires the victim to open the malicious project while holding an active GDevelop cloud session, so impact is limited to confidentiality (CVSS 4.0 base 5.3, medium; independent assessment CVSS 3.1 5.3, UI:R). No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.