CVE-2026-86185
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Risk Assessment
The risk includes remote code execution on the victim's machine and credential theft, potentially leading to full system compromise.
Recommendation
It is recommended to immediately update Bilibili Desktop to a version newer than 1.18.0 and avoid using the application on untrusted networks.
Other vulnerabilities in Bilibili Desktop
Original NVD description (English source)
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS