Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
76 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
26.2.425.8.427.0.0-beta.824.8.522.3.25· Vendor fix available
Issue
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Recommended action: Upgrade to 27.0.0-beta.8 (pre-release), 26.2.4, 25.8.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
26.2.125.8.122.3.2424.8.327.0.0-beta.2· Vendor fix available
Issue
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Recommended action: Upgrade to 27.0.0-beta.2 (pre-release), 26.2.1, 25.8.1 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
23.3.1325.5.024.7.126.0.0-beta.1322.3.19· Vendor fix available
Issue
Impact Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help Specifically this issue can only be exploited if the following conditions are met: Your app is launched with an attacker-controlled working directory The attacker has the ability to write files to that working directory This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future. Workarounds There are no app side workarounds, you must update to a patched version of Electron. Fixed Versions 26.0.0-beta.13 25.5.0 24.7.1 23.3.13 22.3.19 For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Recommended action: Upgrade to 26.0.0-beta.13 (pre-release), 25.5.0, 24.7.1 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
24.0.123.2.325.0.0-alpha.222.3.6· Vendor fix available
Issue
Impact Apps using contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds This issue is exploitable under either of two conditions: If an API exposed to the main world via contextBridge can return an object or array that contains a JS object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown Error: object could not be cloned. If an API exposed to the main world via contextBridge has a return value that throws a user-generated exception while being sent over the bridge, for instance a dynamic getter property on an object that throws an error when being computed. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported and that…
Recommended action: Upgrade to 25.0.0-alpha.2 (pre-release), 24.0.1, 23.2.3 or 22.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
npm electron >= 22.0.0-beta.1, < 22.0.1; >= 23.0.0-alpha.1, < 23.0.0-alpha.2
Fixed in
22.0.123.0.0-alpha.2· Vendor fix available
Issue
Impact A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderers that have sandbox and contextIsolation disabled. i.e. sandbox: false and contextIsolation: false in the webPreferences object. This resulted in incorrectly allowing usage of methods like eval() and new Function, which can result in an expanded attack surface. Patches This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: - 22.0.1 - 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron, especially if they use sandbox: false or contextIsolation: false. Workarounds If upgrading isn't possible, this issue can be addressed without upgrading by enabling at least one of sandbox: true or contextIsolation: true on all renderers. For more information If you have…
Recommended action: Upgrade to 23.0.0-alpha.2 (pre-release) or 22.0.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Recommended action: Upgrade to 19.1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as file://some.website.com/, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials. Patches This issue has been fixed in all current stable versions of Electron. Specifically, these versions contain the fixes: - 21.0.0-beta.1 - 20.0.1 - 19.0.11 - 18.3.7 We recommend all apps upgrade to the latest stable version of Electron. Workarounds If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the WebContents.on('will-redirect') event, for all WebContents: For more information If you have any questions or comments about this advisory, email us at security@electronjs.org. Credit Thanks to user @coolcoolnoworries for…
Recommended action: Upgrade to 20.0.1, 19.0.11 or 18.3.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
16.2.018.0.0-beta.617.2.015.5.0· Vendor fix available
Issue
Impact This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. Please note that this kind of attack would require significant privileges in your own auto updating infrastructure and the ease of that attack entirely depends on your infrastructure security. Patches This has been patched and the following Electron versions contain the fix: 18.0.0-beta.6 17.2.0 16.2.0 15.5.0 Workarounds There are no workarounds for this issue, please update to a patched version of Electron. For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Recommended action: Upgrade to 18.0.0-beta.6 (pre-release), 17.2.0, 16.2.0 or 15.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
18.0.0-beta.615.5.517.2.016.2.6· Vendor fix available
Issue
Impact This vulnerability allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames enabled which in turn allows effective access to ipcRenderer. Please note the misleadingly named nodeIntegrationInSubFrames option does not implicitly grant Node.js access rather it depends on the existing sandbox setting. If your application is sandboxed then nodeIntegrationInSubFrames just gives access to the sandboxed renderer APIs (which includes ipcRenderer). If your application then additionally exposes IPC messages without IPC senderFrame validation that perform privileged actions or return confidential data this access to ipcRenderer can in turn compromise your application / user even with the sandbox enabled. Patches This has been patched and the following Electron versions contain the fix: 18.0.0-beta.6 17.2.0 16.2.6 15.5.5 Workarounds Ensure that all IPC message handlers appropriately validate senderFrame as per our security tutorial…
Recommended action: Upgrade to 18.0.0-beta.6 (pre-release), 17.2.0, 16.2.6 or 15.5.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js childprocess.execFile API call.
Recommended action: Upgrade to 1.6.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.
Recommended action: Upgrade to 1.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
15.3.517.0.0-alpha.613.6.616.0.614.2.4· Vendor fix available
Issue
Impact This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device. All current stable versions of Electron are affected. Patches This has been patched and the following Electron versions contain the fix: 17.0.0-alpha.6 16.0.6 15.3.5 14.2.4 13.6.6 Workarounds Adding this code to your app can workaround the issue. For more information If you have any questions or comments about this advisory, email us at security@electronjs.org.
Recommended action: Upgrade to 17.0.0-alpha.6 (pre-release), 16.0.6, 15.3.5 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. All current stable versions of Electron are affected. Patches This was fixed with #30728, and the following Electron versions contain the fix: - 15.0.0-alpha.10 - 14.0.0 - 13.3.0 - 12.1.0 - 11.5.0 Workarounds If your app enables contextIsolation, this vulnerability is significantly more difficult for an attacker to exploit. Further, if your app does not depend on the createThumbnailFromPath API, then you can simply disable the functionality. In the main process, before the 'ready' event: For more information If you have any questions or comments about this advisory, email us at security@electronjs.org.
Recommended action: Upgrade to 13.3.0, 12.1.0 or 11.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app does ANY of the following, then it is impacted by this issue: - Uses remote - Calls webContents.sendToFrame - Calls event.reply in an IPC message handler Patches This has been fixed in the following versions: - 9.4.0 - 10.2.0 - 11.1.0 - 12.0.0-beta.9 Workarounds There are no workarounds for this issue. For more information If you have any questions or comments about this advisory, email us at security@electronjs.org.
Recommended action: Upgrade to 11.1.0, 10.2.0 or 9.4.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-beta.610.1.28.5.29.3.1· Vendor fix available
Issue
Impact Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nativeWindowOpen: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions 11.0.0-beta.6 10.1.2 9.3.1 8.5.2 For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 11.0.0-beta.6 (pre-release), 10.1.2, 9.3.1 or 8.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. Patches 11.0.0-beta.1 10.0.1 9.3.0 8.5.1 Workarounds Sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway. For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 10.0.1, 9.3.0 or 8.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. Workarounds Ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect. Fixed Versions 9.0.0-beta.21 8.2.4 7.2.4 For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 8.2.4 or 7.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Apps using both contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions 9.0.0-beta.21 8.2.4 7.2.4 For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 8.2.4 or 7.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions 9.0.0-beta.21 8.2.4 7.2.4 Non-Impacted Versions 9.0.0-beta. For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 8.2.4 or 7.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions 9.0.0-beta.21 8.2.4 7.2.4 6.1.11 For more information If you have any questions or comments about this advisory: Email us at security@electronjs.org
Recommended action: Upgrade to 8.2.4, 7.2.4 or 6.1.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.0.0-beta.71.8.82.0.81.7.16· Vendor fix available
Issue
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution. More information to determine if you are impacted can be found on the electron blog. Recommendation Upgrade Electron to =3.0.0-beta.7, =2.0.8, =1.8.8, or =1.7.16.
Recommended action: Upgrade to 3.0.0-beta.7 (pre-release), 2.0.8, 1.8.8 or 1.7.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled. Recommendation Update to electron version 1.7.8 or later.
Recommended action: Upgrade to 1.7.8 or 1.6.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Recommended action: Upgrade to 1.8.2-beta5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows execution of arbitrary remote code - Disables Node.js integration - Does not explicitly declare webviewTag: false in its webPreferences - Does not enable the nativeWindowOption option - Does not intercept new-window events and manually override event.newGuest without using the supplied options tag Recommendation Update to electron version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later. If you are unable to update your Electron version can mitigate the vulnerability with the following code.
Recommended action: Upgrade to 2.0.0-beta.5 (pre-release), 1.8.4 or 1.7.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of electron may be susceptible to a remote code execution flaw when certain conditions are met: 1. The electron application is running on Windows. 2. The electron application registers as the default handler for a protocol, such as nodeapp://. This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron. MacOS and Linux are not vulnerable. Recommendation Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance: If for some reason you are unable to upgrade your Electron version, you can append -- as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options. The double dash -- signifies the end of command options, after which only positional parameters are accepted.
Recommended action: Upgrade to 1.8.2-beta.4 (pre-release), 1.7.11 or 1.6.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.