GitHub Desktop

Synopsis

GitHub Desktop is an open-source Electron-based app for working with your GitHub.com or GitHub Enterprise account. It uses the dugite and dugite-native libraries for performing git operations.

Focus areas

• Remote code execution via protocol handlers such as x-github-client://
• Code execution without user interaction when cloning or fetching malicious repositories

Out of scope

• Code execution requiring social-engineering or unlikely user interaction is typically not eligible for rewards.
• Vulnerabilities which do not trigger code-execution are out-of-scope and ineligible for reward. We encourage you to open an issue upstream

Recently collected GitHub Desktop bounties:

1		10000 pts joernchen of Phenoelit Argument injection when cloning Git submodules
2		5000 pts @zhuowei GitHub Desktop remote code execution
3		2500 pts xpn XSS in GitHub Desktop
4		2500 pts Aaron GitHub Desktop for Windows remote code execution