electron
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 79 advisory(ies) without a verdict
Advisories (79)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links | 45.0.0-alpha.1 – < 45.0.0-alpha.6 ; 44.0.0-alpha.1 – < 44.3.0 ; 43.0.0-alpha.1 – < 43.7.0 ; … | Undetermined |
| GHSA-2q4g-w47c-4674 Unpreventable top-level navigation | 8.0.0-beta.0 – < 8.5.1 ; 9.0.0-beta.0 – < 9.3.0 ; 10.0.0-beta.0 – < 10.0.1 | Undetermined |
| GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.1 ; … | Undetermined |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron | < 13.6.6 ; 14.0.0-beta.1 – < 14.2.4 ; 15.0.0-beta.1 – < 15.3.5 ; … | Undetermined |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry | < 42.11.6 ; 43.0.0-alpha.1 – < 43.7.3 ; 44.0.0-alpha.1 – < 44.4.3 ; … | Undetermined |
| GHSA-4f78-qhmw-8j8m Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter | < 39.8.7 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.0 ; … | Undetermined |
| GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.3 ; 40.0.0-alpha.1 – < 40.8.3 ; … | Undetermined |
| GHSA-4w88-rjj3-x7wp Chromium Remote Code Execution in electron | < 1.6.14 ; 1.7.0 – < 1.7.8 | Undetermined |
| GHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callback | < 39.8.1 ; 40.0.0-alpha.1 – < 40.7.0 ; 41.0.0-alpha.1 – < 41.0.0 | Undetermined |
| GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron | 8.0.0-beta.0 – < 8.5.2 ; 9.0.0-beta.0 – < 9.3.1 ; 10.0.0-beta.0 – < 10.1.2 ; … | Undetermined |
| GHSA-5c9j-mhmv-5xgx Electron: shell.openPath path validation bypass via embedded null byte | 42.0.0-alpha.1 – < 42.0.0-beta.1 ; 41.0.0-alpha.1 – < 41.1.1 ; 40.0.0-alpha.1 – < 40.9.0 ; … | Undetermined |
| GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.0 ; … | Undetermined |
| GHSA-6h98-cf9g-vmg2 Electron vulnerable to URL spoofing via PDFium | 1.7.0 – < 1.7.6 | Undetermined |
| GHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImage | < 28.3.2 ; 29.0.0-alpha.1 – < 29.3.3 ; 30.0.0-alpha.1 – < 30.0.3 | Undetermined |
| GHSA-6vrv-94jv-crrg Context isolation bypass via Promise in Electron | < 6.1.11 ; 7.0.0 – < 7.2.4 ; 8.0.0 – < 8.2.4 | Undetermined |
| GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle | < 15.5.0 ; 16.0.0 – < 16.2.0 ; 17.0.0 – < 17.2.0 ; … | Undetermined |
| GHSA-7fv9-m79r-j9x8 Electron vulnerable to remote command execution | < 1.6.8 | Undetermined |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron | < 22.3.24 ; 24.0.0-alpha.1 – < 24.8.3 ; 25.0.0-alpha.1 – < 25.8.1 ; … | Undetermined |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd | < 22.3.19 ; 23.0.0-alpha.1 – < 23.3.13 ; 24.0.0-alpha.1 – < 24.7.1 ; … | Undetermined |
| GHSA-8337-3p73-46f4 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.0 ; 40.0.0-alpha.1 – < 40.7.0 ; … | Undetermined |
| GHSA-8x5q-pvf5-64mp Electron: Use-after-free in offscreen shared texture release() callback | 33.0.0-alpha.1 – < 39.8.5 ; 40.0.0-alpha.1 – < 40.8.5 ; 41.0.0-alpha.1 – < 41.1.0 ; … | Undetermined |
| GHSA-8xwg-wv7v-4vqp Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration | 1.7.0 – < 1.7.13 ; 1.8.0 – < 1.8.4 ; 2.0.0-beta.1 – < 2.0.0-beta.5 | Undetermined |
| GHSA-9899-m83m-qhpj Electron: USB device selection not validated against filtered device list | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.0 ; 40.0.0-alpha.1 – < 40.7.0 ; … | Undetermined |
| GHSA-98mx-cjp9-gchm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission | 45.0.0-alpha.1 – < 45.0.0-alpha.4 ; 44.0.0-alpha.1 – < 44.1.1 ; 43.0.0-alpha.1 – < 43.5.1 ; … | Undetermined |
| GHSA-995f-9x5r-2rcj Heap buffer overflow in GPU | 19.0.0 – < 19.1.8 | Undetermined |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin | < 42.11.3 ; 43.0.0-alpha.1 – < 43.7.0 ; 44.0.0-alpha.1 – < 44.3.0 ; … | Undetermined |
| GHSA-9f4c-93c8-jc8g Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path | 42.0.0-alpha.1 – < 42.0.1 ; 40.0.0-alpha.1 – < 41.10.3 ; < 39.8.10 | Undetermined |
| GHSA-9pf5-hg6p-4pwp Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin | < 39.8.7 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.0 ; … | Undetermined |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | < 41.10.6 ; 42.0.0-alpha.1 – < 42.9.2 ; 43.0.0-alpha.1 – < 43.4.1 ; … | Undetermined |
| GHSA-9w97-2464-8783 Electron: Use-after-free in download save dialog callback | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.0 ; 40.0.0-alpha.1 – < 40.7.0 ; … | Undetermined |
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.0 ; 40.0.0-alpha.1 – < 40.7.0 ; … | Undetermined |
| GHSA-f2r8-jv7c-xqmp Electron: DevTools embedder handler executes arbitrary files via shell open | < 39.8.9 ; 40.0.0-alpha.1 – < 40.9.2 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-f37v-82c4-4x64 Electron: Crash in clipboard.readImage() on malformed clipboard image data | < 39.8.5 ; 40.0.0-alpha.1 – < 40.8.5 ; 41.0.0-alpha.1 – < 41.1.0 ; … | Undetermined |
| GHSA-f3pv-wv63-48x8 Electron: Named window.open targets not scoped to the opener's browsing context | < 39.8.5 ; 40.0.0-alpha.1 – < 40.8.5 ; 41.0.0-alpha.1 – < 41.1.0 ; … | Undetermined |
| GHSA-f9mq-jph6-9mhm Arbitrary file read via window-open IPC in Electron | < 7.2.4 ; 8.0.0 – < 8.2.4 | Undetermined |
| GHSA-ff2p-hmqr-hxm4 Electron: contextBridge object copy honors prototype setters | < 39.8.9 ; 40.0.0-alpha.1 – < 40.9.2 ; 41.0.0-alpha.1 – < 41.2.2 ; … | Undetermined |
| GHSA-fjqr-fx3f-g4rv Electron protocol handler browser vulnerable to Command Injection | < 1.8.2-beta5 | Undetermined |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin | 45.0.0-alpha.1 – < 45.0.0-alpha.5 ; 44.0.0-alpha.1 – < 44.3.0 ; 43.0.0-alpha.1 – < 43.7.0 ; … | Undetermined |
| GHSA-gr2m-v5gq-v685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions | < 41.10.6 ; 42.0.0-alpha.1 – < 42.9.2 ; 43.0.0-alpha.1 – < 43.4.1 ; … | Undetermined |
| GHSA-gvcj-pfq2-wxj7 High severity vulnerability that affects electron | < 0.33.5 | Undetermined |
| GHSA-gxh7-wv9q-fwfr Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled | 22.0.0-beta.1 – < 22.0.1 ; 23.0.0-alpha.1 – < 23.0.0-alpha.2 | Undetermined |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry | < 42.11.6 ; 43.0.0-alpha.1 – < 43.7.3 ; 44.0.0-alpha.1 – < 44.4.3 ; … | Undetermined |
| GHSA-h7rp-cf8h-j98x Electron: Context isolation bypass via Function.prototype.bind hijack | < 39.8.9 ; 40.0.0-alpha.1 – < 40.9.2 ; 41.0.0-alpha.1 – < 41.2.2 ; … | Undetermined |
| GHSA-h9jc-284h-533g Context isolation bypass via contextBridge in Electron | < 7.2.4 ; 8.0.0 – < 8.2.4 | Undetermined |
| GHSA-hq2x-r82h-9wj4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab | < 41.10.4 ; 42.0.0-alpha.1 – < 42.5.2 ; 43.0.0-alpha.1 – < 43.0.0 | Undetermined |
| GHSA-hv9c-qwqg-qj3v Electron webPreferences vulnerability can be used to perform remote code execution | 1.7.0 – < 1.7.16 ; 1.8.0 – < 1.8.8 ; 2.0.0 – < 2.0.8 ; … | Undetermined |
| GHSA-hvf8-h2qh-37m9 IPC messages delivered to the wrong frame in Electron | < 9.4.0 ; 10.0.0 – < 10.2.0 ; 11.0.0 – < 11.1.0 | Undetermined |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable | 22.0.0 – < 22.3.24 ; 24.0.0 – < 24.8.3 ; 25.0.0 – < 25.8.1 ; … | Undetermined |
| GHSA-j84w-jfhq-vhvj Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled | < 41.10.6 ; 42.0.0-alpha.1 – < 42.9.2 ; 43.0.0-alpha.1 – < 43.4.1 ; … | Undetermined |
| GHSA-jfqg-hf23-qpw2 Electron: Context Isolation bypass via contextBridge VideoFrame transfer | 39.0.0-alpha.1 – < 39.8.0 ; 40.0.0-alpha.1 – < 40.7.0 ; 41.0.0-alpha.1 – < 41.0.0-beta.8 | Undetermined |
| GHSA-jfqx-fxh3-c62j Electron: Unquoted executable path in app.setLoginItemSettings on Windows | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.0 ; … | Undetermined |
| GHSA-jjp3-mq3x-295m Electron: Use-after-free in PowerMonitor on Windows and macOS | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.0 ; … | Undetermined |
| GHSA-jm7p-cc5g-qwxx Electron: Parent process code-sign check is spoofable | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.1 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates | 45.0.0-alpha.1 – < 45.0.0-beta.6 ; 44.0.0-alpha.1 – < 44.9.1 ; 43.0.0-alpha.1 – < 43.8.1 ; … | Undetermined |
| GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-m93v-9qjc-3g79 Context isolation bypass via leaked cross-context objects in Electron | < 7.2.4 ; 8.0.0 – < 8.2.4 | Undetermined |
| GHSA-mpjm-v997-c4h4 Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API | < 11.5.0 ; 12.0.0 – < 12.1.0 ; 13.0.0 – < 13.3.0 | Undetermined |
| GHSA-mq8j-3h7h-p8g7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled | < 15.5.5 ; 16.0.0 – < 16.2.6 ; 17.0.0 – < 17.2.0 ; … | Undetermined |
| GHSA-mwmh-mq4g-g6gr Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.1 ; … | Undetermined |
| GHSA-p2jh-44qj-pf2v Exfiltration of hashed SMB credentials on Windows via file:// redirect | < 18.3.7 ; 20.0.0-beta.1 – < 20.0.1 ; 19.0.0-beta.1 – < 19.0.11 | Undetermined |
| GHSA-p2rr-rvmm-c5fp Electron: Sandboxed iframes can launch external protocol handlers | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-p7v2-p9m8-qqg7 Electron context isolation bypass via nested unserializable return value | < 22.3.6 ; 23.0.0-alpha.1 – < 23.2.3 ; 24.0.0-alpha.1 – < 24.0.1 ; … | Undetermined |
| GHSA-pfmc-3mgc-p6fp Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size | < 39.8.10 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-q6m5-f73j-m9mc Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow | 42.3.1 – < 42.3.3 | Undetermined |
| GHSA-qmv3-fv6v-rmhq Electron: Sandboxed preload code cache can be poisoned by a compromised renderer | 42.3.3 – < 42.10.0 ; 43.0.0-beta.1 – < 43.5.0 ; 44.0.0-alpha.1 – < 44.0.0-beta.6 | Undetermined |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding | < 22.3.25 ; 24.0.0 – < 24.8.5 ; 25.0.0 – < 25.8.4 ; … | Undetermined |
| GHSA-r4w5-6pfg-jxp5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session | 43.0.0-alpha.1 – < 43.0.0 ; 42.0.0-alpha.1 – < 42.5.1 ; 41.0.0-alpha.1 – < 41.9.1 ; … | Undetermined |
| GHSA-r5p7-gp4j-qhrx Electron: Incorrect origin passed to permission request handler for iframe requests | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.1 ; … | Undetermined |
| GHSA-v3j7-r9gq-3gjw Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads | 42.0.0-alpha.1 – < 42.0.0 ; 41.0.0-alpha.1 – < 41.4.0 ; 40.0.0-alpha.1 – < 40.9.3 ; … | Undetermined |
| GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.1 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-v93f-fgjr-hjrj Electron: window.open features string controls some window options considered privileged | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.0 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification | < 35.7.5 ; 36.0.0-alpha.1 – < 36.8.1 ; 37.0.0-alpha.1 – < 37.3.1 ; … | Undetermined |
| GHSA-vv43-5jgx-7qv8 Electron: Local race condition in Squirrel.Mac update installation on macOS | < 39.8.10 ; 40.0.0-alpha.1 – < 41.10.5 ; 42.0.0-alpha.1 – < 42.0.0-beta.2 | Undetermined |
| GHSA-w222-53c6-c86p Remote Code Execution in electron | 1.7.0 – < 1.7.11 ; 1.6.0 – < 1.6.16 ; 1.8.0 – < 1.8.2-beta.4 | Undetermined |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame | 45.0.0-alpha.1 – < 45.0.0-alpha.13 ; 44.0.0-alpha.1 – < 44.5.0 ; 43.0.0-alpha.1 – < 43.7.6 ; … | Undetermined |
| GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup | < 39.8.8 ; 40.0.0-alpha.1 – < 40.9.1 ; 41.0.0-alpha.1 – < 41.2.1 ; … | Undetermined |
| GHSA-xj5x-m3f3-5x3h Electron: Service worker can spoof executeJavaScript IPC replies | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.1 ; 40.0.0-alpha.1 – < 40.8.1 ; … | Undetermined |
| GHSA-xw5q-g62x-2qjc electron ASAR Integrity bypass by just modifying the content | 30.0.0-alpha.1 – < 30.0.5 ; 31.0.0-alpha.1 – < 31.0.0-beta.1 | Undetermined |
| GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes | < 38.8.6 ; 39.0.0-alpha.1 – < 39.8.4 ; 40.0.0-alpha.1 – < 40.8.4 ; … | Undetermined |
Sources
| Source | Licence |
|---|