A critical code injection vulnerability in GitKraken Desktop resulting from insecure Electron configurations poses a significant risk of arbitrary command execution.

The application is susceptible to code injection because of misconfigured Electron Fuses, specifically the 'RunAsNode' setting, which allows an unauthenticated attacker to execute arbitrary code.

Exploitation of this vulnerability allows an attacker to achieve full remote code execution on the host machine, potentially leading to total system compromise and data exfiltration. The CVSS score of 9.8 highlights the extreme risk, as it allows unauthenticated attackers to gain complete control over the affected workstation.

Immediate Action: Update GitKraken Desktop to the latest available version provided by the vendor to remediate the insecure configuration.

Proactive Monitoring: Review endpoint security logs for unexpected child processes or unusual outbound network connections originating from the GitKraken application.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to monitor for malicious activity and restrict the execution of unauthorized binaries.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability necessitates immediate action to update all installations of GitKraken Desktop. Administrators should ensure that all instances are patched, as the lack of authentication requirements makes this an attractive target for automated exploitation.