p PatchFirst

PatchFirst · Latest vulnerabilities

electron vulnerabilities · Page 4

Vulnerabilities published for electron in the last 30 days: 14. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 79

  1. CVE-2022-29257

    Medium · CVSS 6.6EPSS 0.92%Fix available

    Electron's AutoUpdater module fails to validate certain nested components of the bundle

    Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6,

    electron electron electron electronNode.js
    • Update to 15.5.0
    • Update to 16.2.0
    • Update to 17.2.0
    • Update to 18.0.0-beta.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2022-29247

    Low · CVSS 2.2EPSS 1.05%Fix available

    Exposure of Resource to Wrong Sphere in Electron

    Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If th

    electron electron electron electronNode.js
    • Update to 15.5.5
    • Update to 16.2.6
    • Update to 17.2.0
    • Update to 18.0.0-beta.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2022-21718

    Low · CVSS 3.4EPSS 0.95%Fix available

    Renderers can obtain access to random bluetooth device without permission in Electron

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.

    electron electron electron electron electronNode.js
    • Update to 13.6.6
    • Update to 14.2.4
    • Update to 15.3.5
    • Update to 16.0.6
    • Update to 17.0.0-alpha.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2021-39184

    Medium · CVSS 6.8EPSS 1.05%Fix available

    Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIso

    electron electron electronNode.js
    • Update to 11.5.0
    • Update to 12.1.0
    • Update to 13.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2020-26272

    Medium · CVSS 5.4EPSS 1.75%Fix available

    Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

    The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.

    electron electron electronNode.js
    • Update to 10.2.0
    • Update to 11.1.0
    • Update to 9.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2020-15215

    Medium · CVSS 5.6EPSS 0.68%Fix available

    Context isolation bypass in Electron

    Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

    electron electron electron electronNode.js
    • Update to 10.1.2
    • Update to 11.0.0-beta.6
    • Update to 8.5.2
    • Update to 9.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2020-15174

    High · CVSS 7.5EPSS 1.35%Fix available

    Unpreventable top-level navigation in Electron

    In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

    electron electron electronNode.js
    • Update to 10.0.1
    • Update to 8.5.1
    • Update to 9.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2020-15096

    Medium · CVSS 6.8EPSS 0.81%Fix available

    Context isolation bypass via Promise in Electron

    In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.

    electron electron electronNode.js
    • Update to 6.1.11
    • Update to 7.2.4
    • Update to 8.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2020-4075

    Medium · CVSS 6.8EPSS 1.18%Fix available

    Arbitrary file read via window-open IPC in Electron

    In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

    electron electronNode.js
    • Update to 7.2.4
    • Update to 8.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2020-4076

    High · CVSS 7.8EPSS 0.37%Fix available

    Context isolation bypass via leaked cross-context objects in Electron

    In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

    electron electronNode.js
    • Update to 7.2.4
    • Update to 8.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2020-4077

    High · CVSS 7.7EPSS 1%Fix available

    Context isolation bypass via contextBridge in Electron

    In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

    electron electronNode.js
    • Update to 7.2.4
    • Update to 8.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2018-15685

    High · CVSS 8.1EPSS 10.43%Public exploitFix available

    CVE-2018-15685

    GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

    electron electron electron electronNode.js
    • Update to 1.7.16
    • Update to 1.8.8
    • Update to 2.0.8
    • Update to 3.0.0-beta.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2017-16151

    Critical · CVSS 9.8EPSS 2.67%Fix available

    CVE-2017-16151

    Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

    electron electronNode.js
    • Update to 1.6.14
    • Update to 1.7.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2018-1000136

    High · CVSS 8.1EPSS 5.08%Fix available

    CVE-2018-1000136

    Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

    electron electron electronNode.js
    • Update to 1.7.13
    • Update to 1.8.4
    • Update to 2.0.0-beta.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2018-1000118

    High · CVSS 8.8EPSS 2.4%Fix available

    CVE-2018-1000118

    Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.

    electronNode.js
    • Update to 1.8.2-beta5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2018-1000006

    High · CVSS 8.8EPSS 84.38%Public exploitFix available

    CVE-2018-1000006

    GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.

    electron electron electronNode.js
    • Update to 1.6.16
    • Update to 1.7.11
    • Update to 1.8.2-beta.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2017-12581

    High · CVSS 8.1EPSS 6.69%Fix available

    CVE-2017-12581

    GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.

    electronNode.js
    • Update to 1.6.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →