Vulnerability in Bilibili Desktop
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (6.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce (third-party-advisory)
- github.com/LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce/blob/main/advisory… (technical-description)
- app.bilibili.com/ (product)
- www.vulncheck.com/advisories/bilibili-desktop-through-1.18.0-remote-code-execut… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-86185?
- CVE-2026-86185 is a high-severity vulnerability in Bilibili Desktop, classified under Improper Certificate Validation. CVSS score: 8.0/10. Published 2026-09-05.
- How severe is CVE-2026-86185?
- High severity. CVSS v3 base score is 8.0 out of 10.