CVE-2020-15215
CVE-2020-15215 · Context isolation bypass in Electron
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
CVSS 5.6 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
electron
- Versions
- >= 8.0.0-beta.0, < 8.5.2: Affected
- >= 9.0.0-beta.0, < 9.3.1: Affected
- >= 10.0.0-beta.0, < 10.1.2: Affected
- >= 11.0.0-beta.0, < 11.0.0-beta.6: Affected
No fix published
electron npm
- Affected ranges
- SEMVER: ≥ 8.0.0-beta.0, < 8.5.2
Update to 8.5.2
electron npm
- Affected ranges
- SEMVER: ≥ 9.0.0-beta.0, < 9.3.1
Update to 9.3.1
electron npm
- Affected ranges
- SEMVER: ≥ 10.0.0-beta.0, < 10.1.2
Update to 10.1.2
electron npm
- Affected ranges
- SEMVER: ≥ 11.0.0-beta.0, < 11.0.0-beta.6
Update to 11.0.0-beta.6