Multiple Vulnerabilities in GoSign Desktop lead to Remote Code Execution

Researchers identified multiple vulnerabilities in GoSign Desktop, the on‑premise electronic signature tool from Tinexta InfoCert, which can lead to remote code execution when TLS certificate validation is disabled in proxy configurations and the update mechanism uses an unsigned manifest. GoSign Desktop versions affected include 2.4.0 for Windows, Linux, and macOS, with a fix released in version 2.4.1 on 4 November 2025, though TLS bypass remains when a proxy is configured.

The flaws enable a MitM attacker to modify the manifest, replace the update package, and supply a matching SHA‑256 hash, resulting in remote code execution, credential theft and potential privilege escalation. The issue carries a CVSS 3.1 score of 8.2 and CWE mappings for improper certificate validation, improper verification of cryptographic signatures, and exposure of sensitive information.

GoSign Desktop has been used by about 1.6 million people in 2021 to perform over 830 million signing transactions, underscoring its central role in the Italian and European digital ecosystem. The vendor’s disclosure response involved ACN/CSIRT Italia, with a 16 October 2025 technical call and a 31 October 2025 deadline for a fix that was then released silently on 4 November 2025.