CVE-2025-23040

Vulnerability

Overview A credential exfiltration vulnerability (CVE-2025-23040) exists in GitHub Desktop, an Electron-based Git client. When a user clones a repository (directly or via a submodule) with a maliciously crafted remote URL, the credential request from Git can be misinterpreted by GitHub Desktop, causing it to send credentials for a *different* host than the one Git is actually communicating with [2]. This leverages the git-credential protocol [1], which GitHub Desktop uses to supply authentication to Git.

Attack

Vector An attacker must convince a user to clone a repository that contains a specially crafted remote URL. No further authentication is required beyond the user's normal interaction; the attack can be triggered automatically if the user simply clones a malicious repository or a legitimate repo that includes a malicious submodule. GitHub Desktop invokes git clone or git fetch, and when Git requests credentials (via the git-credential protocol) for the actual remote host, the malicious URL causes the desktop app to misinterpret that request and send credentials for a different, attacker-controlled host [2].

Impact

Successful exploitation could leak the user's GitHub username and OAuth token, or credentials for any other Git remote host stored in GitHub Desktop, to an unrelated (attacker-controlled) host. This could lead to unauthorized access to the user's GitHub repositories and personal data [2].

Mitigation

The vulnerability is fixed in GitHub Desktop version 3.4.12 or greater. Users should update immediately. Those who suspect they may have been affected should revoke their GitHub Desktop OAuth token (following guidance in [3]) and any other relevant credentials stored in the application [2].