CVE-2025-23040

GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials.

• CWE-522

• https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps
• https://git-scm.com/docs/git-credential
• https://github.com/desktop/desktop/security/advisories/GHSA-36mm-rh9q-cpqq

Published

Jan 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23035WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23036WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23037WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23038WeGIA is an open source web manager with a focus on the Port…5.4
• CVE-2025-23039Caido is a web security auditing toolkit. A Cross-Site Scrip…5.2
• CVE-2025-2304A Privilege Escalation through a Mass Assignment exists in C…9.4
• CVE-2025-23041Umbraco.Forms is a web form framework written for the nuget …5.3
• CVE-2025-23042Gradio is an open-source Python package that allows quick bu…7.5
• CVE-2025-23044PwnDoc is a penetration test report generator. There is no C…8.1
• CVE-2025-23045Computer Vision Annotation Tool (CVAT) is an interactive vid…9.8
• CVE-2025-23046GLPI is a free asset and IT management software package. Sta…7.5
• CVE-2025-23047Cilium is a networking, observability, and security solution…6.5