CVE-2025-51387

critical · 9.8

The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.

9.8

CVSS

0.5%

EPSS (exploit prob.)

45th

EPSS percentile

2025-08-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
axosoft	gitkraken_desktop	10.8.0
axosoft	gitkraken_desktop	11.1.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/r3ggi/electroniz3r
https://packetstorm.news/files/id/207677
https://www.electronjs.org/blog/statement-run-as-node-cves#mitigation

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-51387