CVE-2026-75357: n/a

CVE-2026-75357 is a critical vulnerability in Bilibili Desktop v1.17.9 that permits remote attackers to execute arbitrary code via the bili-inject.js and bili-bridge.js components. The vulnerability is classified under CWE-94, indicating improper control over code generation. The CVSS v3.1 base score is 9.8, reflecting its high impact with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No known exploits are reported in the wild, and no patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full system compromise including complete loss of confidentiality, integrity, and availability. The vulnerability requires no privileges and no user interaction, making it highly exploitable over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published. Until a patch is available, users should exercise caution when using Bilibili Desktop v1.17.9 and consider restricting network exposure of the application.