electron (npm)
Advisories
283
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 45.0.0-beta.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install electron@45.0.0-beta.6yarn
yarn add electron@45.0.0-beta.6pnpm
pnpm add electron@45.0.0-beta.6Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates |
High EPSS 0.38% |
< 42.11.16 | 42.11.16 |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates |
High EPSS 0.38% |
>= 45.0.0-alpha.1, < 45.0.0-beta.6 | 45.0.0-beta.6 |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates |
High EPSS 0.38% |
>= 44.0.0-alpha.1, < 44.9.1 | 44.9.1 |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates |
High EPSS 0.38% |
>= 43.0.0-alpha.1, < 43.8.1 | 43.8.1 |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
Low EPSS 0.18% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.9 | 45.0.0-alpha.9 |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
Low EPSS 0.18% |
< 42.11.6 | 42.11.6 |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
Low EPSS 0.18% |
>= 43.0.0-alpha.1, < 43.7.3 | 43.7.3 |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
Low EPSS 0.18% |
>= 44.0.0-alpha.1, < 44.4.3 | 44.4.3 |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry |
Low EPSS 0.19% |
< 42.11.6 | 42.11.6 |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry |
Low EPSS 0.19% |
>= 43.0.0-alpha.1, < 43.7.3 | 43.7.3 |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry |
Low EPSS 0.19% |
>= 44.0.0-alpha.1, < 44.4.3 | 44.4.3 |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry |
Low EPSS 0.19% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.9 | 45.0.0-alpha.9 |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin |
Medium EPSS 0.22% |
>= 44.0.0-alpha.1, < 44.3.0 | 44.3.0 |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin |
Medium EPSS 0.22% |
< 42.11.3 | 42.11.3 |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin |
Medium EPSS 0.22% |
>= 43.0.0-alpha.1, < 43.7.0 | 43.7.0 |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin |
Medium EPSS 0.22% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.5 | 45.0.0-alpha.5 |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin |
Medium EPSS 0.24% |
< 42.11.3 | 42.11.3 |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin |
Medium EPSS 0.24% |
>= 43.0.0-alpha.1, < 43.7.0 | 43.7.0 |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin |
Medium EPSS 0.24% |
>= 44.0.0-alpha.1, < 44.3.0 | 44.3.0 |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin |
Medium EPSS 0.24% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.5 | 45.0.0-alpha.5 |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame |
Medium EPSS 0.24% |
< 42.11.9 | 42.11.9 |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame |
Medium EPSS 0.24% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.13 | 45.0.0-alpha.13 |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame |
Medium EPSS 0.24% |
>= 44.0.0-alpha.1, < 44.5.0 | 44.5.0 |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame |
Medium EPSS 0.24% |
>= 43.0.0-alpha.1, < 43.7.6 | 43.7.6 |
| GHSA-98mx-cjp9-gchm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
Low EPSS 0.59% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.4 | 45.0.0-alpha.4 |
| GHSA-98mx-cjp9-gchm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
Low EPSS 0.59% |
>= 43.0.0-alpha.1, < 43.5.1 | 43.5.1 |
| GHSA-98mx-cjp9-gchm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
Low EPSS 0.59% |
< 42.11.1 | 42.11.1 |
| GHSA-98mx-cjp9-gchm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
Low EPSS 0.59% |
>= 44.0.0-alpha.1, < 44.1.1 | 44.1.1 |
| GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links |
Medium EPSS 0.22% |
>= 44.0.0-alpha.1, < 44.3.0 | 44.3.0 |
| GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links |
Medium EPSS 0.22% |
>= 45.0.0-alpha.1, < 45.0.0-alpha.6 | 45.0.0-alpha.6 |
| GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links |
Medium EPSS 0.22% |
< 42.11.3 | 42.11.3 |
| GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links |
Medium EPSS 0.22% |
>= 43.0.0-alpha.1, < 43.7.0 | 43.7.0 |
| GHSA-vv43-5jgx-7qv8 Electron: Local race condition in Squirrel.Mac update installation on macOS |
Medium EPSS 0.09% |
< 39.8.10 | 39.8.10 |
| GHSA-vv43-5jgx-7qv8 Electron: Local race condition in Squirrel.Mac update installation on macOS |
Medium EPSS 0.09% |
>= 40.0.0-alpha.1, < 41.10.5 | 41.10.5 |
| GHSA-vv43-5jgx-7qv8 Electron: Local race condition in Squirrel.Mac update installation on macOS |
Medium EPSS 0.09% |
>= 42.0.0-alpha.1, < 42.0.0-beta.2 | 42.0.0-beta.2 |
| GHSA-qmv3-fv6v-rmhq Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
High EPSS 0.10% |
>= 43.0.0-beta.1, < 43.5.0 | 43.5.0 |
| GHSA-qmv3-fv6v-rmhq Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
High EPSS 0.10% |
>= 42.3.3, < 42.10.0 | 42.10.0 |
| GHSA-qmv3-fv6v-rmhq Electron: Sandboxed preload code cache can be poisoned by a compromised renderer |
High EPSS 0.10% |
>= 44.0.0-alpha.1, < 44.0.0-beta.6 | 44.0.0-beta.6 |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
Critical EPSS 0.48% |
>= 43.0.0-alpha.1, < 43.4.1 | 43.4.1 |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
Critical EPSS 0.48% |
>= 42.0.0-alpha.1, < 42.9.2 | 42.9.2 |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
Critical EPSS 0.48% |
< 41.10.6 | 41.10.6 |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions |
Critical EPSS 0.48% |
>= 44.0.0-alpha.1, < 44.0.0-beta.5 | 44.0.0-beta.5 |
| GHSA-j84w-jfhq-vhvj Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled |
High EPSS 0.21% |
>= 43.0.0-alpha.1, < 43.4.1 | 43.4.1 |
| GHSA-j84w-jfhq-vhvj Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled |
High EPSS 0.21% |
< 41.10.6 | 41.10.6 |
| GHSA-j84w-jfhq-vhvj Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled |
High EPSS 0.21% |
>= 42.0.0-alpha.1, < 42.9.2 | 42.9.2 |
| GHSA-j84w-jfhq-vhvj Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled |
High EPSS 0.21% |
>= 44.0.0-alpha.1, < 44.0.0-beta.5 | 44.0.0-beta.5 |
| GHSA-gr2m-v5gq-v685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
Medium EPSS 0.24% |
>= 42.0.0-alpha.1, < 42.9.2 | 42.9.2 |
| GHSA-gr2m-v5gq-v685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
Medium EPSS 0.24% |
>= 44.0.0-alpha.1, < 44.0.0-beta.5 | 44.0.0-beta.5 |
| GHSA-gr2m-v5gq-v685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
Medium EPSS 0.24% |
< 41.10.6 | 41.10.6 |
| GHSA-gr2m-v5gq-v685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions |
Medium EPSS 0.24% |
>= 43.0.0-alpha.1, < 43.4.1 | 43.4.1 |
| GHSA-hq2x-r82h-9wj4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab |
Medium EPSS 0.13% |
>= 43.0.0-alpha.1, < 43.0.0 | 43.0.0 |
| GHSA-hq2x-r82h-9wj4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab |
Medium EPSS 0.13% |
>= 42.0.0-alpha.1, < 42.5.2 | 42.5.2 |
| GHSA-hq2x-r82h-9wj4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab |
Medium EPSS 0.13% |
< 41.10.4 | 41.10.4 |
| GHSA-p2rr-rvmm-c5fp Electron: Sandboxed iframes can launch external protocol handlers |
Medium EPSS 0.43% |
< 39.8.8 | 39.8.8 |
| GHSA-p2rr-rvmm-c5fp Electron: Sandboxed iframes can launch external protocol handlers |
Medium EPSS 0.43% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-p2rr-rvmm-c5fp Electron: Sandboxed iframes can launch external protocol handlers |
Medium EPSS 0.43% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-p2rr-rvmm-c5fp Electron: Sandboxed iframes can launch external protocol handlers |
Medium EPSS 0.43% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-f2r8-jv7c-xqmp Electron: DevTools embedder handler executes arbitrary files via shell open |
Medium EPSS 0.19% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-f2r8-jv7c-xqmp Electron: DevTools embedder handler executes arbitrary files via shell open |
Medium EPSS 0.19% |
< 39.8.9 | 39.8.9 |
| GHSA-f2r8-jv7c-xqmp Electron: DevTools embedder handler executes arbitrary files via shell open |
Medium EPSS 0.19% |
>= 40.0.0-alpha.1, < 40.9.2 | 40.9.2 |
| GHSA-f2r8-jv7c-xqmp Electron: DevTools embedder handler executes arbitrary files via shell open |
Medium EPSS 0.19% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-ff2p-hmqr-hxm4 Electron: contextBridge object copy honors prototype setters |
Medium EPSS 0.56% |
>= 42.0.0-alpha.1, < 42.0.0-beta.4 | 42.0.0-beta.4 |
| GHSA-ff2p-hmqr-hxm4 Electron: contextBridge object copy honors prototype setters |
Medium EPSS 0.56% |
< 39.8.9 | 39.8.9 |
| GHSA-ff2p-hmqr-hxm4 Electron: contextBridge object copy honors prototype setters |
Medium EPSS 0.56% |
>= 40.0.0-alpha.1, < 40.9.2 | 40.9.2 |
| GHSA-ff2p-hmqr-hxm4 Electron: contextBridge object copy honors prototype setters |
Medium EPSS 0.56% |
>= 41.0.0-alpha.1, < 41.2.2 | 41.2.2 |
| GHSA-4f78-qhmw-8j8m Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
Medium EPSS 0.53% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-4f78-qhmw-8j8m Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
Medium EPSS 0.53% |
>= 42.0.0-alpha.1, < 42.0.0-beta.1 | 42.0.0-beta.1 |
| GHSA-4f78-qhmw-8j8m Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
Medium EPSS 0.53% |
>= 41.0.0-alpha.1, < 41.2.0 | 41.2.0 |
| GHSA-4f78-qhmw-8j8m Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
Medium EPSS 0.53% |
< 39.8.7 | 39.8.7 |
| GHSA-9f4c-93c8-jc8g Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path |
High EPSS 0.43% |
>= 42.0.0-alpha.1, < 42.0.1 | 42.0.1 |
| GHSA-9f4c-93c8-jc8g Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path |
High EPSS 0.43% |
< 39.8.10 | 39.8.10 |
| GHSA-9f4c-93c8-jc8g Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path |
High EPSS 0.43% |
>= 40.0.0-alpha.1, < 41.10.3 | 41.10.3 |
| GHSA-v93f-fgjr-hjrj Electron: window.open features string controls some window options considered privileged |
Medium EPSS 0.56% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-v93f-fgjr-hjrj Electron: window.open features string controls some window options considered privileged |
Medium EPSS 0.56% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-v93f-fgjr-hjrj Electron: window.open features string controls some window options considered privileged |
Medium EPSS 0.56% |
< 39.8.8 | 39.8.8 |
| GHSA-v93f-fgjr-hjrj Electron: window.open features string controls some window options considered privileged |
Medium EPSS 0.56% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-r4w5-6pfg-jxp5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session |
Medium EPSS 0.26% |
>= 40.0.0-alpha.1, < 40.10.6 | 40.10.6 |
| GHSA-r4w5-6pfg-jxp5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session |
Medium EPSS 0.26% |
>= 43.0.0-alpha.1, < 43.0.0 | 43.0.0 |
| GHSA-r4w5-6pfg-jxp5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session |
Medium EPSS 0.26% |
>= 42.0.0-alpha.1, < 42.5.1 | 42.5.1 |
| GHSA-r4w5-6pfg-jxp5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session |
Medium EPSS 0.26% |
>= 41.0.0-alpha.1, < 41.9.1 | 41.9.1 |
| GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader |
Medium EPSS 0.32% |
>= 40.0.0-alpha.1, < 40.9.1 | 40.9.1 |
| GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader |
Medium EPSS 0.32% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader |
Medium EPSS 0.32% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader |
Medium EPSS 0.32% |
< 39.8.8 | 39.8.8 |
| GHSA-v3j7-r9gq-3gjw Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads |
High EPSS 0.35% |
>= 42.0.0-alpha.1, < 42.0.0 | 42.0.0 |
| GHSA-v3j7-r9gq-3gjw Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads |
High EPSS 0.35% |
< 39.8.10 | 39.8.10 |
| GHSA-v3j7-r9gq-3gjw Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads |
High EPSS 0.35% |
>= 40.0.0-alpha.1, < 40.9.3 | 40.9.3 |
| GHSA-v3j7-r9gq-3gjw Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads |
High EPSS 0.35% |
>= 41.0.0-alpha.1, < 41.4.0 | 41.4.0 |
| GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries |
Medium EPSS 0.26% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries |
Medium EPSS 0.26% |
< 39.8.8 | 39.8.8 |
| GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries |
Medium EPSS 0.26% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-m55f-7gqj-fr98 Electron: Extension tab APIs operate across session boundaries |
Medium EPSS 0.26% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-5c9j-mhmv-5xgx Electron: shell.openPath path validation bypass via embedded null byte |
Medium EPSS 0.13% |
< 39.8.6 | 39.8.6 |
| GHSA-5c9j-mhmv-5xgx Electron: shell.openPath path validation bypass via embedded null byte |
Medium EPSS 0.13% |
>= 42.0.0-alpha.1, < 42.0.0-beta.1 | 42.0.0-beta.1 |
| GHSA-5c9j-mhmv-5xgx Electron: shell.openPath path validation bypass via embedded null byte |
Medium EPSS 0.13% |
>= 41.0.0-alpha.1, < 41.1.1 | 41.1.1 |
| GHSA-5c9j-mhmv-5xgx Electron: shell.openPath path validation bypass via embedded null byte |
Medium EPSS 0.13% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-h7rp-cf8h-j98x Electron: Context isolation bypass via Function.prototype.bind hijack |
High EPSS 0.29% |
< 39.8.9 | 39.8.9 |
| GHSA-h7rp-cf8h-j98x Electron: Context isolation bypass via Function.prototype.bind hijack |
High EPSS 0.29% |
>= 40.0.0-alpha.1, < 40.9.2 | 40.9.2 |
| GHSA-h7rp-cf8h-j98x Electron: Context isolation bypass via Function.prototype.bind hijack |
High EPSS 0.29% |
>= 42.0.0-alpha.1, < 42.0.0-beta.5 | 42.0.0-beta.5 |
| GHSA-h7rp-cf8h-j98x Electron: Context isolation bypass via Function.prototype.bind hijack |
High EPSS 0.29% |
>= 41.0.0-alpha.1, < 41.2.2 | 41.2.2 |
| GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup |
Medium EPSS 0.18% |
>= 40.0.0-alpha.1, < 40.9.1 | 40.9.1 |
| GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup |
Medium EPSS 0.18% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup |
Medium EPSS 0.18% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup |
Medium EPSS 0.18% |
< 39.8.8 | 39.8.8 |
| GHSA-9pf5-hg6p-4pwp Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin |
Medium EPSS 0.19% |
>= 42.0.0-alpha.1, < 42.0.0-beta.1 | 42.0.0-beta.1 |
| GHSA-9pf5-hg6p-4pwp Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin |
Medium EPSS 0.19% |
< 39.8.7 | 39.8.7 |
| GHSA-9pf5-hg6p-4pwp Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin |
Medium EPSS 0.19% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-9pf5-hg6p-4pwp Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin |
Medium EPSS 0.19% |
>= 41.0.0-alpha.1, < 41.2.0 | 41.2.0 |
| GHSA-pfmc-3mgc-p6fp Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size |
Low EPSS 0.14% |
>= 40.0.0-alpha.1, < 40.9.0 | 40.9.0 |
| GHSA-pfmc-3mgc-p6fp Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size |
Low EPSS 0.14% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-pfmc-3mgc-p6fp Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size |
Low EPSS 0.14% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-pfmc-3mgc-p6fp Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size |
Low EPSS 0.14% |
< 39.8.10 | 39.8.10 |
| GHSA-jm7p-cc5g-qwxx Electron: Parent process code-sign check is spoofable |
Medium EPSS 0.10% |
>= 42.0.0-alpha.1, < 42.0.0-beta.3 | 42.0.0-beta.3 |
| GHSA-jm7p-cc5g-qwxx Electron: Parent process code-sign check is spoofable |
Medium EPSS 0.10% |
>= 41.0.0-alpha.1, < 41.2.1 | 41.2.1 |
| GHSA-jm7p-cc5g-qwxx Electron: Parent process code-sign check is spoofable |
Medium EPSS 0.10% |
>= 40.0.0-alpha.1, < 40.9.1 | 40.9.1 |
| GHSA-jm7p-cc5g-qwxx Electron: Parent process code-sign check is spoofable |
Medium EPSS 0.10% |
< 39.8.8 | 39.8.8 |
| GHSA-q6m5-f73j-m9mc Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow |
Critical EPSS 0.43% |
>= 42.3.1, < 42.3.3 | 42.3.3 |
| GHSA-f37v-82c4-4x64 Electron: Crash in clipboard.readImage() on malformed clipboard image data |
Low EPSS 0.14% |
>= 42.0.0-alpha.1, < 42.0.0-alpha.5 | 42.0.0-alpha.5 |
| GHSA-f37v-82c4-4x64 Electron: Crash in clipboard.readImage() on malformed clipboard image data |
Low EPSS 0.14% |
>= 41.0.0-alpha.1, < 41.1.0 | 41.1.0 |
| GHSA-f37v-82c4-4x64 Electron: Crash in clipboard.readImage() on malformed clipboard image data |
Low EPSS 0.14% |
>= 40.0.0-alpha.1, < 40.8.5 | 40.8.5 |
| GHSA-f37v-82c4-4x64 Electron: Crash in clipboard.readImage() on malformed clipboard image data |
Low EPSS 0.14% |
< 39.8.5 | 39.8.5 |
| GHSA-f3pv-wv63-48x8 Electron: Named window.open targets not scoped to the opener's browsing context |
High EPSS 0.30% |
< 39.8.5 | 39.8.5 |
| GHSA-f3pv-wv63-48x8 Electron: Named window.open targets not scoped to the opener's browsing context |
High EPSS 0.30% |
>= 40.0.0-alpha.1, < 40.8.5 | 40.8.5 |
| GHSA-f3pv-wv63-48x8 Electron: Named window.open targets not scoped to the opener's browsing context |
High EPSS 0.30% |
>= 41.0.0-alpha.1, < 41.1.0 | 41.1.0 |
| GHSA-f3pv-wv63-48x8 Electron: Named window.open targets not scoped to the opener's browsing context |
High EPSS 0.30% |
>= 42.0.0-alpha.1, < 42.0.0-alpha.5 | 42.0.0-alpha.5 |
| GHSA-8x5q-pvf5-64mp Electron: Use-after-free in offscreen shared texture release() callback |
Medium EPSS 0.10% |
>= 42.0.0-alpha.1, < 42.0.0-alpha.5 | 42.0.0-alpha.5 |
| GHSA-8x5q-pvf5-64mp Electron: Use-after-free in offscreen shared texture release() callback |
Medium EPSS 0.10% |
>= 41.0.0-alpha.1, < 41.1.0 | 41.1.0 |
| GHSA-8x5q-pvf5-64mp Electron: Use-after-free in offscreen shared texture release() callback |
Medium EPSS 0.10% |
>= 33.0.0-alpha.1, < 39.8.5 | 39.8.5 |
| GHSA-8x5q-pvf5-64mp Electron: Use-after-free in offscreen shared texture release() callback |
Medium EPSS 0.10% |
>= 40.0.0-alpha.1, < 40.8.5 | 40.8.5 |
| GHSA-jfqg-hf23-qpw2 Electron: Context Isolation bypass via contextBridge VideoFrame transfer |
Medium EPSS 0.33% |
>= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 |
| GHSA-jfqg-hf23-qpw2 Electron: Context Isolation bypass via contextBridge VideoFrame transfer |
Medium EPSS 0.33% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-jfqg-hf23-qpw2 Electron: Context Isolation bypass via contextBridge VideoFrame transfer |
Medium EPSS 0.33% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS |
High EPSS 0.16% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS |
High EPSS 0.16% |
< 38.8.6 | 38.8.6 |
| GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS |
High EPSS 0.16% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS |
High EPSS 0.16% |
>= 40.0.0-alpha.1, < 40.8.0 | 40.8.0 |
| GHSA-xj5x-m3f3-5x3h Electron: Service worker can spoof executeJavaScript IPC replies |
Medium EPSS 0.13% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-xj5x-m3f3-5x3h Electron: Service worker can spoof executeJavaScript IPC replies |
Medium EPSS 0.13% |
< 38.8.6 | 38.8.6 |
| GHSA-xj5x-m3f3-5x3h Electron: Service worker can spoof executeJavaScript IPC replies |
Medium EPSS 0.13% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-xj5x-m3f3-5x3h Electron: Service worker can spoof executeJavaScript IPC replies |
Medium EPSS 0.13% |
>= 40.0.0-alpha.1, < 40.8.1 | 40.8.1 |
| GHSA-r5p7-gp4j-qhrx Electron: Incorrect origin passed to permission request handler for iframe requests |
Medium EPSS 0.12% |
< 38.8.6 | 38.8.6 |
| GHSA-r5p7-gp4j-qhrx Electron: Incorrect origin passed to permission request handler for iframe requests |
Medium EPSS 0.12% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-r5p7-gp4j-qhrx Electron: Incorrect origin passed to permission request handler for iframe requests |
Medium EPSS 0.12% |
>= 40.0.0-alpha.1, < 40.8.1 | 40.8.1 |
| GHSA-r5p7-gp4j-qhrx Electron: Incorrect origin passed to permission request handler for iframe requests |
Medium EPSS 0.12% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
Medium EPSS 0.22% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
Medium EPSS 0.22% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
Medium EPSS 0.22% |
< 38.8.6 | 38.8.6 |
| GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
Medium EPSS 0.22% |
>= 40.0.0-alpha.1, < 40.8.1 | 40.8.1 |
| GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
Critical EPSS 0.29% |
>= 40.0.0-alpha.1, < 40.8.4 | 40.8.4 |
| GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
Critical EPSS 0.29% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
Critical EPSS 0.29% |
< 38.8.6 | 38.8.6 |
| GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
Critical EPSS 0.29% |
>= 39.0.0-alpha.1, < 39.8.4 | 39.8.4 |
| GHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callback |
High EPSS 0.45% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callback |
High EPSS 0.45% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callback |
High EPSS 0.45% |
< 39.8.1 | 39.8.1 |
| GHSA-mwmh-mq4g-g6gr Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
High EPSS 0.24% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-mwmh-mq4g-g6gr Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
High EPSS 0.24% |
>= 41.0.0-alpha.1, < 41.0.0 | 41.0.0 |
| GHSA-mwmh-mq4g-g6gr Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
High EPSS 0.24% |
>= 40.0.0-alpha.1, < 40.8.1 | 40.8.1 |
| GHSA-mwmh-mq4g-g6gr Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
High EPSS 0.24% |
< 38.8.6 | 38.8.6 |
| GHSA-9w97-2464-8783 Electron: Use-after-free in download save dialog callback |
High EPSS 0.21% |
>= 41.0.0-alpha.1, < 41.0.0-beta.7 | 41.0.0-beta.7 |
| GHSA-9w97-2464-8783 Electron: Use-after-free in download save dialog callback |
High EPSS 0.21% |
< 38.8.6 | 38.8.6 |
| GHSA-9w97-2464-8783 Electron: Use-after-free in download save dialog callback |
High EPSS 0.21% |
>= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 |
| GHSA-9w97-2464-8783 Electron: Use-after-free in download save dialog callback |
High EPSS 0.21% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-8337-3p73-46f4 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks |
High EPSS 0.29% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-8337-3p73-46f4 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks |
High EPSS 0.29% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-8337-3p73-46f4 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks |
High EPSS 0.29% |
>= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 |
| GHSA-8337-3p73-46f4 Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks |
High EPSS 0.29% |
< 38.8.6 | 38.8.6 |
| GHSA-jjp3-mq3x-295m Electron: Use-after-free in PowerMonitor on Windows and macOS |
High EPSS 0.25% |
< 38.8.6 | 38.8.6 |
| GHSA-jjp3-mq3x-295m Electron: Use-after-free in PowerMonitor on Windows and macOS |
High EPSS 0.25% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-jjp3-mq3x-295m Electron: Use-after-free in PowerMonitor on Windows and macOS |
High EPSS 0.25% |
>= 40.0.0-alpha.1, < 40.8.0 | 40.8.0 |
| GHSA-jjp3-mq3x-295m Electron: Use-after-free in PowerMonitor on Windows and macOS |
High EPSS 0.25% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference |
High EPSS 0.30% |
>= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 |
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference |
High EPSS 0.30% |
< 38.8.6 | 38.8.6 |
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference |
High EPSS 0.30% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-9wfr-w7mm-pc7f Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference |
High EPSS 0.30% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-jfqx-fxh3-c62j Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
High EPSS 0.13% |
< 38.8.6 | 38.8.6 |
| GHSA-jfqx-fxh3-c62j Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
High EPSS 0.13% |
>= 39.0.0-alpha.1, < 39.8.1 | 39.8.1 |
| GHSA-jfqx-fxh3-c62j Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
High EPSS 0.13% |
>= 40.0.0-alpha.1, < 40.8.0 | 40.8.0 |
| GHSA-jfqx-fxh3-c62j Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
High EPSS 0.13% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
Medium EPSS 0.21% |
>= 40.0.0-alpha.1, < 40.8.3 | 40.8.3 |
| GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
Medium EPSS 0.21% |
< 38.8.6 | 38.8.6 |
| GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
Medium EPSS 0.21% |
>= 39.0.0-alpha.1, < 39.8.3 | 39.8.3 |
| GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
Medium EPSS 0.21% |
>= 41.0.0-alpha.1, < 41.0.3 | 41.0.3 |
| GHSA-9899-m83m-qhpj Electron: USB device selection not validated against filtered device list |
Medium EPSS 0.17% |
>= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 |
| GHSA-9899-m83m-qhpj Electron: USB device selection not validated against filtered device list |
Medium EPSS 0.17% |
< 38.8.6 | 38.8.6 |
| GHSA-9899-m83m-qhpj Electron: USB device selection not validated against filtered device list |
Medium EPSS 0.17% |
>= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 |
| GHSA-9899-m83m-qhpj Electron: USB device selection not validated against filtered device list |
Medium EPSS 0.17% |
>= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 |
| GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification |
Medium EPSS 0.28% |
>= 37.0.0-alpha.1, < 37.3.1 | 37.3.1 |
| GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification |
Medium EPSS 0.28% |
< 35.7.5 | 35.7.5 |
| GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification |
Medium EPSS 0.28% |
>= 36.0.0-alpha.1, < 36.8.1 | 36.8.1 |
| GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification |
Medium EPSS 0.28% |
>= 38.0.0-alpha.1, < 38.0.0-beta.6 | 38.0.0-beta.6 |
| GHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImage |
Medium EPSS 0.16% |
>= 29.0.0-alpha.1, < 29.3.3 | 29.3.3 |
| GHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImage |
Medium EPSS 0.16% |
>= 30.0.0-alpha.1, < 30.0.3 | 30.0.3 |
| GHSA-6r2x-8pq8-9489 Electron vulnerable to Heap Buffer Overflow in NativeImage |
Medium EPSS 0.16% |
< 28.3.2 | 28.3.2 |
| GHSA-xw5q-g62x-2qjc electron ASAR Integrity bypass by just modifying the content |
High EPSS 0.12% |
>= 31.0.0-alpha.1, < 31.0.0-beta.1 | 31.0.0-beta.1 |
| GHSA-xw5q-g62x-2qjc electron ASAR Integrity bypass by just modifying the content |
High EPSS 0.12% |
>= 30.0.0-alpha.1, < 30.0.5 | 30.0.5 |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
>= 23.0.0-alpha.1, <= 23.3.13 | No fix yet |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
>= 27.0.0-alpha.1, < 27.0.0-alpha.7 | 27.0.0-alpha.7 |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
>= 26.0.0-alpha.1, < 26.2.1 | 26.2.1 |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
>= 25.0.0-alpha.1, < 25.8.1 | 25.8.1 |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
>= 24.0.0-alpha.1, < 24.8.3 | 24.8.3 |
| GHSA-7m48-wc93-9g85 ASAR Integrity bypass via filetype confusion in electron |
High EPSS 0.21% |
< 22.3.24 | 22.3.24 |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding Known exploited |
High EPSS 49.01% |
< 22.3.25 | 22.3.25 |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding Known exploited |
High EPSS 49.01% |
>= 24.0.0, < 24.8.5 | 24.8.5 |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding Known exploited |
High EPSS 49.01% |
>= 25.0.0, < 25.8.4 | 25.8.4 |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding Known exploited |
High EPSS 49.01% |
>= 26.0.0, < 26.2.4 | 26.2.4 |
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding Known exploited |
High EPSS 49.01% |
>= 27.0.0-alpha.1, < 27.0.0-beta.8 | 27.0.0-beta.8 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 26.0.0, < 26.2.1 | 26.2.1 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 22.0.0, < 22.3.24 | 22.3.24 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 24.0.0, < 24.8.3 | 24.8.3 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 25.0.0, < 25.8.1 | 25.8.1 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 27.0.0-beta.1, < 27.0.0-beta.2 | 27.0.0-beta.2 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 22.0.0, < 22.3.24 | 22.3.24 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 24.0.0, < 24.8.3 | 24.8.3 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 25.0.0, < 25.8.1 | 25.8.1 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 26.0.0, < 26.2.1 | 26.2.1 |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable Known exploited |
High EPSS 99.98% |
>= 27.0.0-beta.1, < 27.0.0-beta.2 | 27.0.0-beta.2 |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd |
Medium EPSS 0.49% |
< 22.3.19 | 22.3.19 |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd |
Medium EPSS 0.49% |
>= 23.0.0-alpha.1, < 23.3.13 | 23.3.13 |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd |
Medium EPSS 0.49% |
>= 24.0.0-alpha.1, < 24.7.1 | 24.7.1 |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd |
Medium EPSS 0.49% |
>= 25.0.0-alpha.1, < 25.5.0 | 25.5.0 |
| GHSA-7x97-j373-85x5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd |
Medium EPSS 0.49% |
>= 26.0.0-alpha.1, < 26.0.0-beta.13 | 26.0.0-beta.13 |
| GHSA-p7v2-p9m8-qqg7 Electron context isolation bypass via nested unserializable return value |
High EPSS 0.59% |
>= 25.0.0-alpha.1, < 25.0.0-alpha.2 | 25.0.0-alpha.2 |
| GHSA-p7v2-p9m8-qqg7 Electron context isolation bypass via nested unserializable return value |
High EPSS 0.59% |
< 22.3.6 | 22.3.6 |
| GHSA-p7v2-p9m8-qqg7 Electron context isolation bypass via nested unserializable return value |
High EPSS 0.59% |
>= 23.0.0-alpha.1, < 23.2.3 | 23.2.3 |
| GHSA-p7v2-p9m8-qqg7 Electron context isolation bypass via nested unserializable return value |
High EPSS 0.59% |
>= 24.0.0-alpha.1, < 24.0.1 | 24.0.1 |
| GHSA-gxh7-wv9q-fwfr Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled |
Critical EPSS 0.66% |
>= 23.0.0-alpha.1, < 23.0.0-alpha.2 | 23.0.0-alpha.2 |
| GHSA-gxh7-wv9q-fwfr Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled |
Critical EPSS 0.66% |
>= 22.0.0-beta.1, < 22.0.1 | 22.0.1 |
| GHSA-995f-9x5r-2rcj Heap buffer overflow in GPU Known exploited |
Critical EPSS 31.86% |
>= 19.0.0, < 19.1.8 | 19.1.8 |
| GHSA-p2jh-44qj-pf2v Exfiltration of hashed SMB credentials on Windows via file:// redirect |
Medium EPSS 0.62% |
< 18.3.7 | 18.3.7 |
| GHSA-p2jh-44qj-pf2v Exfiltration of hashed SMB credentials on Windows via file:// redirect |
Medium EPSS 0.62% |
>= 20.0.0-beta.1, < 20.0.1 | 20.0.1 |
| GHSA-p2jh-44qj-pf2v Exfiltration of hashed SMB credentials on Windows via file:// redirect |
Medium EPSS 0.62% |
>= 19.0.0-beta.1, < 19.0.11 | 19.0.11 |
| GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle |
Medium EPSS 0.92% |
< 15.5.0 | 15.5.0 |
| GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle |
Medium EPSS 0.92% |
>= 18.0.0-beta.1, < 18.0.0-beta.6 | 18.0.0-beta.6 |
| GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle |
Medium EPSS 0.92% |
>= 16.0.0, < 16.2.0 | 16.2.0 |
| GHSA-77xc-hjv8-ww97 AutoUpdater module fails to validate certain nested components of the bundle |
Medium EPSS 0.92% |
>= 17.0.0, < 17.2.0 | 17.2.0 |
| GHSA-mq8j-3h7h-p8g7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled |
Low EPSS 1.05% |
>= 17.0.0, < 17.2.0 | 17.2.0 |
| GHSA-mq8j-3h7h-p8g7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled |
Low EPSS 1.05% |
>= 16.0.0, < 16.2.6 | 16.2.6 |
| GHSA-mq8j-3h7h-p8g7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled |
Low EPSS 1.05% |
>= 18.0.0-beta.1, < 18.0.0-beta.6 | 18.0.0-beta.6 |
| GHSA-mq8j-3h7h-p8g7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled |
Low EPSS 1.05% |
< 15.5.5 | 15.5.5 |
| GHSA-7fv9-m79r-j9x8 Electron vulnerable to remote command execution |
High EPSS 6.69% |
< 1.6.8 | 1.6.8 |
| GHSA-6h98-cf9g-vmg2 Electron vulnerable to URL spoofing via PDFium |
Medium EPSS 0.98% |
>= 1.7.0, < 1.7.6 | 1.7.6 |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron |
Low EPSS 0.95% |
>= 17.0.0-alpha.1, < 17.0.0-alpha.6 | 17.0.0-alpha.6 |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron |
Low EPSS 0.95% |
< 13.6.6 | 13.6.6 |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron |
Low EPSS 0.95% |
>= 14.0.0-beta.1, < 14.2.4 | 14.2.4 |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron |
Low EPSS 0.95% |
>= 15.0.0-beta.1, < 15.3.5 | 15.3.5 |
| GHSA-3p22-ghq8-v749 Renderers can obtain access to random bluetooth device without permission in Electron |
Low EPSS 0.95% |
>= 16.0.0-beta.1, < 16.0.6 | 16.0.6 |
| GHSA-mpjm-v997-c4h4 Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API |
Medium EPSS 1.05% |
< 11.5.0 | 11.5.0 |
| GHSA-mpjm-v997-c4h4 Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API |
Medium EPSS 1.05% |
>= 12.0.0, < 12.1.0 | 12.1.0 |
| GHSA-mpjm-v997-c4h4 Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API |
Medium EPSS 1.05% |
>= 13.0.0, < 13.3.0 | 13.3.0 |
| GHSA-hvf8-h2qh-37m9 IPC messages delivered to the wrong frame in Electron |
Medium EPSS 1.75% |
>= 10.0.0, < 10.2.0 | 10.2.0 |
| GHSA-hvf8-h2qh-37m9 IPC messages delivered to the wrong frame in Electron |
Medium EPSS 1.75% |
>= 11.0.0, < 11.1.0 | 11.1.0 |
| GHSA-hvf8-h2qh-37m9 IPC messages delivered to the wrong frame in Electron |
Medium EPSS 1.75% |
< 9.4.0 | 9.4.0 |
| GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron |
Medium EPSS 0.68% |
>= 8.0.0-beta.0, < 8.5.2 | 8.5.2 |
| GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron |
Medium EPSS 0.68% |
>= 10.0.0-beta.0, < 10.1.2 | 10.1.2 |
| GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron |
Medium EPSS 0.68% |
>= 11.0.0-beta.0, < 11.0.0-beta.6 | 11.0.0-beta.6 |
| GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron |
Medium EPSS 0.68% |
>= 9.0.0-beta.0, < 9.3.1 | 9.3.1 |
| GHSA-2q4g-w47c-4674 Unpreventable top-level navigation |
High EPSS 1.35% |
>= 10.0.0-beta.0, < 10.0.1 | 10.0.1 |
| GHSA-2q4g-w47c-4674 Unpreventable top-level navigation |
High EPSS 1.35% |
>= 9.0.0-beta.0, < 9.3.0 | 9.3.0 |
| GHSA-2q4g-w47c-4674 Unpreventable top-level navigation |
High EPSS 1.35% |
>= 8.0.0-beta.0, < 8.5.1 | 8.5.1 |
| GHSA-f9mq-jph6-9mhm Arbitrary file read via window-open IPC in Electron |
Medium EPSS 1.18% |
< 7.2.4 | 7.2.4 |
| GHSA-f9mq-jph6-9mhm Arbitrary file read via window-open IPC in Electron |
Medium EPSS 1.18% |
>= 8.0.0, < 8.2.4 | 8.2.4 |
| GHSA-h9jc-284h-533g Context isolation bypass via contextBridge in Electron |
High EPSS 1.00% |
>= 8.0.0, < 8.2.4 | 8.2.4 |
| GHSA-h9jc-284h-533g Context isolation bypass via contextBridge in Electron |
High EPSS 1.00% |
< 7.2.4 | 7.2.4 |
| GHSA-m93v-9qjc-3g79 Context isolation bypass via leaked cross-context objects in Electron |
High EPSS 0.37% |
>= 8.0.0, < 8.2.4 | 8.2.4 |
| GHSA-m93v-9qjc-3g79 Context isolation bypass via leaked cross-context objects in Electron |
High EPSS 0.37% |
< 7.2.4 | 7.2.4 |
| GHSA-6vrv-94jv-crrg Context isolation bypass via Promise in Electron |
Medium EPSS 0.81% |
>= 8.0.0, < 8.2.4 | 8.2.4 |
| GHSA-6vrv-94jv-crrg Context isolation bypass via Promise in Electron |
Medium EPSS 0.81% |
< 6.1.11 | 6.1.11 |
| GHSA-6vrv-94jv-crrg Context isolation bypass via Promise in Electron |
Medium EPSS 0.81% |
>= 7.0.0, < 7.2.4 | 7.2.4 |
| GHSA-hv9c-qwqg-qj3v Electron webPreferences vulnerability can be used to perform remote code execution |
High EPSS 10.30% |
>= 1.8.0, < 1.8.8 | 1.8.8 |
| GHSA-hv9c-qwqg-qj3v Electron webPreferences vulnerability can be used to perform remote code execution |
High EPSS 10.30% |
>= 1.7.0, < 1.7.16 | 1.7.16 |
| GHSA-hv9c-qwqg-qj3v Electron webPreferences vulnerability can be used to perform remote code execution |
High EPSS 10.30% |
>= 3.0.0-beta.1, < 3.0.0-beta.7 | 3.0.0-beta.7 |
| GHSA-hv9c-qwqg-qj3v Electron webPreferences vulnerability can be used to perform remote code execution |
High EPSS 10.30% |
>= 2.0.0, < 2.0.8 | 2.0.8 |
| GHSA-4w88-rjj3-x7wp Chromium Remote Code Execution in electron |
Critical EPSS 2.67% |
>= 1.7.0, < 1.7.8 | 1.7.8 |
| GHSA-4w88-rjj3-x7wp Chromium Remote Code Execution in electron |
Critical EPSS 2.67% |
< 1.6.14 | 1.6.14 |
| GHSA-fjqr-fx3f-g4rv Electron protocol handler browser vulnerable to Command Injection |
High EPSS 2.40% |
< 1.8.2-beta5 | 1.8.2-beta5 |
| GHSA-8xwg-wv7v-4vqp Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration |
High EPSS 5.08% |
>= 1.8.0, < 1.8.4 | 1.8.4 |
| GHSA-8xwg-wv7v-4vqp Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration |
High EPSS 5.08% |
>= 1.7.0, < 1.7.13 | 1.7.13 |
| GHSA-8xwg-wv7v-4vqp Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration |
High EPSS 5.08% |
>= 2.0.0-beta.1, < 2.0.0-beta.5 | 2.0.0-beta.5 |
| GHSA-w222-53c6-c86p Remote Code Execution in electron |
High EPSS 84.38% |
>= 1.7.0, < 1.7.11 | 1.7.11 |
| GHSA-w222-53c6-c86p Remote Code Execution in electron |
High EPSS 84.38% |
>= 1.6.0, < 1.6.16 | 1.6.16 |
| GHSA-w222-53c6-c86p Remote Code Execution in electron |
High EPSS 84.38% |
>= 1.8.0, < 1.8.2-beta.4 | 1.8.2-beta.4 |
| GHSA-gvcj-pfq2-wxj7 High severity vulnerability that affects electron |
High EPSS 0.43% |
< 0.33.5 | 0.33.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor