{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-17T02:13:53.010","vulnerabilities":[{"cve":{"id":"CVE-2025-48064","sourceIdentifier":"security-advisories@github.com","published":"2025-05-21T18:15:53.383","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network share. This affects GitHub Desktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file diff in the history view GitHub Desktop will call `git log` or `git diff` with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. As a security precaution Git will attempt to fully resolve the old and new path via `realpath`, traversing symlinks, to ensure that the resolved paths reside within the repository working directory. This can lead to Git attempting to access a path that resides on a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information such as the computer name, the currently signed in (Windows) user name, and an NTLM hash. GitHub Desktop 3.4.20 and later fix this vulnerability. The beta channel includes the fix in 3.4.20-beta3. As a workaround to use until upgrading is possible, only browse commits in the history view that comes from trusted sources."},{"lang":"es","value":"GitHub Desktop es una aplicación de GitHub de código abierto basada en Electron, diseñada para el desarrollo con Git. Antes de la versión 3.4.20-beta3, un atacante que convenciera a un usuario para que viera un archivo de una confirmación creada por él en el historial podía provocar la divulgación de información si Git intentaba acceder a un recurso compartido de red. Esto afecta a los usuarios de GitHub Desktop en Windows que ven confirmaciones maliciosas en el historial. Los usuarios de macOS no se ven afectados. Al ver la diferencia de un archivo en el historial, GitHub Desktop llamará a `git log` o `git diff` con el identificador de objeto (SHA) de el commit, el nombre del archivo y el nombre anterior del archivo si se le ha cambiado el nombre. Como medida de seguridad, Git intentará resolver completamente la ruta anterior y la nueva mediante `realpath`, atravesando enlaces simbólicos, para garantizar que las rutas resueltas residan dentro del directorio de trabajo del repositorio. Esto puede provocar que Git intente acceder a una ruta que reside en un recurso compartido de red (ruta UNC). Al hacerlo, Windows intentará realizar la autenticación NTLM, que pasa información como el nombre del equipo, el nombre de usuario de Windows que ha iniciado sesión y un hash NTLM. GitHub Desktop 3.4.20 y versiones posteriores corrigen esta vulnerabilidad. El canal beta incluye la corrección en 3.4.20-beta3. Como solución alternativa hasta que sea posible actualizar, examine solo las confirmaciones en la vista del historial que provengan de fuentes confiables."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/desktop/desktop/security/advisories/GHSA-f234-7hj3-vr8j","source":"security-advisories@github.com"}]}}]}