جزئیات آسیب‌پذیری

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.

• https://github.com/r3ggi/electroniz3r
• https://www.electronjs.org/blog/statement-run-as-node-cves#mitigation
• https://packetstorm.news/files/id/207677