{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/bilibili/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bilibili:bilibili_desktop:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-86185"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bilibili Desktop (\u003c= 1.18.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","credential-theft","mitm"],"_cs_type":"advisory","_cs_vendors":["Bilibili"],"content_html":"\u003cp\u003eBilibili Desktop versions through 1.18.0 contain a critical vulnerability where TLS certificate verification is disabled process-wide. This implementation failure allows an attacker in an on-path position to perform Man-in-the-Middle (MitM) attacks by intercepting network traffic and injecting unsigned remote JavaScript configuration files. Because the application fails to perform integrity checks on these configurations, the injected code is executed within the renderer process. The renderer process maintains access to a privileged Inter-Process Communication (IPC) bridge, enabling the attacker to break out of the application sandbox to execute arbitrary system commands or exfiltrate sensitive user credentials. This vulnerability represents a significant risk for users on untrusted networks, as the lack of TLS verification removes the primary defense against traffic interception and malicious payload delivery.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for full compromise of the Bilibili Desktop client. An attacker can achieve Remote Code Execution (RCE) with the privileges of the local user and steal authentication tokens or login credentials stored by the application. This could lead to account takeover and persistence within the user's local system environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Bilibili Desktop to the latest version immediately to ensure TLS certificate verification is enforced and remote configuration integrity is validated. Monitor network logs for unusual certificate mismatches or unauthorized traffic redirection to Bilibili configuration endpoints if the client remains unpatched.\u003c/p\u003e\n","date_modified":"2026-09-05T13:32:12Z","date_published":"2026-09-05T13:32:12Z","id":"https://feed.craftedsignal.io/briefs/2026-09-bilibili-tls-rce/","summary":"Bilibili Desktop versions 1.18.0 and earlier are vulnerable to remote command execution and credential theft due to disabled TLS certificate verification and the execution of unsigned remote JavaScript configurations.","title":"Bilibili Desktop TLS Verification Bypass and Remote JavaScript Injection","url":"https://feed.craftedsignal.io/briefs/2026-09-bilibili-tls-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Bilibili","version":"https://jsonfeed.org/version/1.1"}