Bilibili Desktop versions 1.18.0 and earlier are vulnerable to remote code execution and credential theft due to improper TLS validation and the execution of unsigned remote configuration scripts.

The application incorrectly sets a process-wide environment variable that disables TLS certificate verification, allowing an unauthenticated on-path attacker to intercept traffic. Furthermore, the application fetches and executes remote JavaScript configuration files without any integrity checks, providing an attacker with access to the privileged internal IPC bridge.

Successful exploitation allows an attacker to execute arbitrary system commands in the context of the logged-in user, leading to a total compromise of the host machine. The vulnerability also facilitates the theft of sensitive authentication cookies, posing a severe risk to user accounts and data privacy. With a CVSS score of 8.0, this high-severity vulnerability represents a significant risk to organizational endpoints using the Bilibili Desktop client.

Immediate Action: As no official patch is currently available, users should restrict the use of Bilibili Desktop on untrusted networks and consider uninstalling the application until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor network traffic for anomalous requests to the Bilibili API endpoints and inspect host logs for unauthorized process execution originating from the Bilibili Desktop application.

Compensating Controls: Organizations should employ network-level inspection or host-based firewalls to prevent unauthorized interception of traffic and restrict the application's ability to execute external configuration scripts if possible.

Public Exploit Available: Yes — a detailed technical analysis and proof-of-concept repository exist on GitHub (LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce).

The combination of disabled TLS verification and the execution of unsigned code makes this a critical security failure. Administrators must treat this as an urgent risk to endpoint integrity and restrict software usage until the vendor provides a version that enforces proper certificate validation and code signing.