CVE-2026-86185 in Bilibili
Summary
by MITRE • 09/05/2026
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Bilibili Desktop versions up to 1.18.0 represents a critical failure in application security architecture, specifically concerning transport layer security and code integrity verification. The core technical flaw lies in the global disabling of TLS certificate validation across the entire process scope. By bypassing standard cryptographic checks during network communication, the application fails to authenticate the identity of remote servers it connects to for configuration data. This misconfiguration effectively nullifies the confidentiality and integrity guarantees provided by HTTPS, allowing any entity capable of intercepting network traffic to manipulate the content in transit without detection.
This lack of transport security directly facilitates a more severe vulnerability involving the execution of unsigned remote JavaScript configurations. The application fetches dynamic configuration files from remote servers and executes them as JavaScript within the renderer process. Crucially, this execution occurs without any integrity checks such as cryptographic hashing or digital signatures to verify that the code has not been altered since its creation by the legitimate vendor. This design choice assumes a trusted network environment which is rarely guaranteed in modern computing contexts where man-in-the-middle attacks are prevalent and easily executable using common tooling like SSL stripping or proxy interceptors.
The operational impact of these combined flaws is severe, granting an attacker with on-path access to full control over the application's runtime behavior within the renderer context. By injecting arbitrary JavaScript into the intercepted configuration fetches, an adversary can exploit the privileged Inter-Process Communication IPC bridge available in Electron-based applications. This bridge typically allows communication between untrusted web content and trusted native code. Through this channel, injected malicious scripts can invoke system commands on the host operating system or access sensitive application state data. Consequently, attackers can achieve remote code execution with the privileges of the user running the application or exfiltrate stored login credentials and session tokens, leading to complete account compromise and potential further lateral movement within a networked environment.
From an industry standards perspective, this vulnerability maps directly to CWE-295 Improper Certificate Validation and CWE-862 Missing Authorization for Critical Function if considered in terms of trust boundaries, but more accurately aligns with CWE-347 Improper Verification of Cryptographic Signature regarding the unsigned JavaScript execution. In the context of attack tactics, this scenario exemplifies MITM001 Man-in-the-Middle from the MITRE ATT&CK framework, specifically leveraging techniques related to Intercepting Traffic and potentially Command and Scripting Interpreter for remote code execution via the IPC bridge. The failure to implement Content Security Policy directives that restrict script sources or require integrity attributes further exacerbates the risk profile defined by CWE-798 Use of Hard-coded Credentials if credentials are stored locally and accessed through this compromised channel.
Mitigation strategies must prioritize immediate updates to patched versions where these architectural flaws have been addressed. For environments unable to upgrade immediately, network-level controls such as strict TLS inspection policies with certificate pinning at the application level can help mitigate interception risks, although this is not a substitute for proper code validation. Developers should enforce integrity checks on all remote resources by implementing Subresource Integrity attributes and validating cryptographic signatures before execution. Additionally, restricting IPC bridge access to only whitelisted origins and disabling unnecessary renderer privileges are essential steps to reduce the attack surface available to injected scripts. Regular security audits focusing on transport layer configurations and dynamic code loading mechanisms are recommended to prevent similar architectural weaknesses in future releases.