{"id":"CVE-2026-112303","kind":"vulnerability","aliases":["CVE-2026-112303"],"related":[],"title":"GDevelop desktop: crafted project file leaks gd_resource session cookie","description":"GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.","summary":"GDevelop's desktop app, through version 5.6.284, sends its gd_resource cookie to any server named in a project file's resource URLs. An attacker who gets a victim to open a crafted project can read the cookie and reach the victim's private cloud project resources.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","game-development","gdevelop","package"],"not_affected_if":["no-external-projects","not-signed-in","web-editor-only"],"how_to_check":"- Check the installed GDevelop desktop app version against `5.6.284`, using the app's About dialog or the installed package metadata.\n- Look for any project files from untrusted sources that were opened in the app.","fix":"- Update the GDevelop desktop app to a version newer than `5.6.284`; the sources do not name the exact fixed release.\n- Do not open project files from untrusted sources until the app is updated.","status":"open","published_at":"2026-10-19T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:05+00:00","updated_at":"2026-10-25T04:25:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:25:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GDevelop desktop app to a version newer than `5.6.284`; the sources do not name the exact fixed release.\n- Do not open project files from untrusted sources until the app is updated.","reach":"internet","title":"GDevelop desktop: crafted project file leaks gd_resource session cookie","impact":"medium","summary":"GDevelop's desktop app, through version 5.6.284, sends its gd_resource cookie to any server named in a project file's resource URLs. An attacker who gets a victim to open a crafted project can read the cookie and reach the victim's private cloud project resources.","category":"package","nicknames":[],"who_cares":["gdevelop","desktop","game-development"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker steals session cookie and reads private cloud project resources","analyst_note":"Confirm the first fixed GDevelop desktop version and the exact fix commit; the NVD entry given does not state them.","how_to_check":"- Check the installed GDevelop desktop app version against `5.6.284`, using the app's About dialog or the installed package metadata.\n- Look for any project files from untrusted sources that were opened in the app.","needs_analyst":true,"not_affected_if":["web-editor-only","no-external-projects","not-signed-in"],"who_is_affected":"Anyone who runs the GDevelop desktop app through 5.6.284 and opens project files, especially ones shared from outside the team. The exposure depends on the victim being signed in to GDevelop cloud services, since the leaked cookie is the gd_resource cookie. Teams that only use the web editor or never open external projects are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3334,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112303':13A,16A '-2026':12A,15A '5.6.284':29B,74C 'allow':81C 'app':26B,72C 'attack':47B,82C,92C,99C 'attacker-control':91C 'caus':108C 'cloud':67B,120C 'contain':75C 'control':93C 'cooki':10A,34B,60B,88C,113C 'craft':3A,55B,106C 'credenti':77C 'cve':11A,14A 'desktop':2A,17B,25B,71C 'develop':20B 'downloadlocalfil':109C 'expos':118C 'file':5A,42B,98C 'game':19B 'game-develop':18B 'gd':7A,32B,86C 'gdevelop':1A,21B,23B,70C 'get':49B,101C 'leak':6A,78C 'name':38B 'open':53B,104C 'packag':22B 'privat':66B,119C 'project':4A,41B,56B,68B,97C,107C,121C 'reach':62B 'read':58B 'resourc':8A,33B,44B,69B,87C,94C,122C 'send':30B,111C 'server':37B,116C 'session':9A 'steal':84C 'suppli':90C 'url':45B,95C 'version':28B 'victim':51B,64B,102C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs the GDevelop desktop app through 5.6.284 and opens project files, especially ones shared from outside the team. The exposure depends on the victim being signed in to GDevelop cloud services, since the leaked cookie is the gd_resource cookie. Teams that only use the web editor or never open external projects are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112303","severity":null,"published_at":"2026-10-19T16:17:06+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}