A critical remote code execution vulnerability in Bilibili Desktop allows unauthenticated attackers to gain full control over affected systems.

This vulnerability involves improper validation of inter-process communication (IPC) components, specifically within the bili-inject.js and bili-bridge.js files. An unauthenticated remote attacker can leverage these components to achieve arbitrary code execution on the host machine.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows for full system compromise without requiring user interaction or authentication. Successful exploitation could lead to total loss of confidentiality, integrity, and availability, potentially resulting in data exfiltration, the deployment of ransomware, or the establishment of a persistent backdoor within the corporate network.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the application or uninstall Bilibili Desktop from production environments until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor for unauthorized network connections originating from the application and inspect process execution logs for suspicious child processes spawned by the desktop client.

Compensating Controls: Deploy network-level egress filtering to block unauthorized communication attempts to external domains and utilize host-based endpoint protection to detect and block malicious script execution.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the technical advisory linked by the CVE record.

Given the critical nature of this remote code execution flaw and the existence of a public proof-of-concept, organizations must prioritize the removal or isolation of Bilibili Desktop. Immediate removal is the safest course of action until the vendor provides a verified security update to address the IPC validation failures.