Electron
Monthly
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. No public exploit code is identified at time of analysis and the vulnerability is not in CISA KEV, but the confidentiality impact is rated high by the vendor given the potential to exfiltrate internal application data.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3 via the DevTools 'reveal in file manager' handler, which incorrectly forwarded attacker-supplied paths to the OS shell-open primitive rather than a safe folder-reveal call. Exploitation requires an attacker to already control JavaScript execution within the DevTools frontend - most plausibly through a malicious DevTools extension - while DevTools is open against a window loading untrusted content. No public exploit code exists and the vulnerability is not listed in CISA KEV; patched releases are available across all active Electron stable and beta branches.
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious prototype across the isolation boundary into preload script context, bypassing context isolation in versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Exploitation is conditional on preload scripts accepting object arguments from untrusted content and reading inherited properties without own-property guards. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the scope-change (S:C) CVSS metric reflects that a successful attack crosses the renderer-to-preload privilege boundary, which can have amplified consequences in apps that expose sensitive Node.js APIs through the bridge.
Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an unsanitized `mode` parameter supplied to `webContents.openDevTools()`. Unsandboxed Electron applications where untrusted input reaches the `mode` argument - or where untrusted content embedded in a `<webview>` element can invoke `openDevTools()` - are exposed to full Node.js-level code execution on the host operating system. No public exploit has been identified at time of analysis, but Electron's own GitHub Security Advisory (GHSA-4f78-qhmw-8j8m) confirms the flaw and vendor-released patches are available across all active release tracks.
Session isolation bypass in Electron's custom protocol handler allows cached HTTP responses from defaultSession to leak across otherwise isolated session partitions. Electron versions 40.x through pre-release 43.x are affected when apps use ProtocolResponse.url without specifying ProtocolResponse.session, causing upstream requests to be routed through defaultSession regardless of which session registered the protocol handler. An attacker who can trigger a cross-session cache hit may read confidential session-scoped content (C:H) or partially influence cached responses (I:L) intended for a different, isolated session; no public exploit or CISA KEV listing exists at time of analysis.
Unrestricted HTTP redirect scheme following in Electron's net module (versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3) enables server-side request forgery leading to local file disclosure. When net.fetch() or net.request() follows a redirect issued by an attacker-controlled server targeting a local scheme such as file://, the Electron app can be made to read and expose local filesystem contents if it forwards or returns the response body. No public exploit is identified at time of analysis; however, the vulnerability class (SSRF via redirect scheme bypass, CWE-918) is well understood, and the default redirect-following behavior increases the practical surface area across affected apps.
Path validation bypass in Electron's shell.openPath() allows an attacker-controlled file to be opened in place of one that passed string-based extension validation, due to embedded null bytes not being rejected before OS-level path resolution. Electron-based desktop applications that accept untrusted file paths, validate them using only JavaScript string methods (e.g., endsWith(), regex extension checks), and then pass them to shell.openPath() are affected; apps using Node.js fs APIs (fs.existsSync(), fs.stat()) prior to the call are explicitly not vulnerable. Fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1; no public exploit identified at time of analysis.
Session isolation bypass in Electron allows a malicious or compromised Chrome extension loaded into one session to cross session boundaries and access, navigate, and script windows belonging to a completely separate session. Affected are Electron applications prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 that invoke session.loadExtension and rely on multi-session architecture as a security boundary - a narrowly scoped but architecturally significant trust boundary violation. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires attacker control of an extension the application has explicitly loaded.
Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-based hardening controls restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS, injecting code inside the signed Electron application and inheriting its TCC permissions and keychain access. Only macOS deployments of Electron apps that have explicitly enabled same-signed-parent fuse restrictions are exposed; applications without this hardening are unaffected. No public exploit has been identified at time of analysis, and CVSS AC:H reflects the PID-reuse race-condition timing requirement inherent to the attack.
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity (CVSS 9.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. No public exploit code is identified at time of analysis and the vulnerability is not in CISA KEV, but the confidentiality impact is rated high by the vendor given the potential to exfiltrate internal application data.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3 via the DevTools 'reveal in file manager' handler, which incorrectly forwarded attacker-supplied paths to the OS shell-open primitive rather than a safe folder-reveal call. Exploitation requires an attacker to already control JavaScript execution within the DevTools frontend - most plausibly through a malicious DevTools extension - while DevTools is open against a window loading untrusted content. No public exploit code exists and the vulnerability is not listed in CISA KEV; patched releases are available across all active Electron stable and beta branches.
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious prototype across the isolation boundary into preload script context, bypassing context isolation in versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Exploitation is conditional on preload scripts accepting object arguments from untrusted content and reading inherited properties without own-property guards. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the scope-change (S:C) CVSS metric reflects that a successful attack crosses the renderer-to-preload privilege boundary, which can have amplified consequences in apps that expose sensitive Node.js APIs through the bridge.
Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an unsanitized `mode` parameter supplied to `webContents.openDevTools()`. Unsandboxed Electron applications where untrusted input reaches the `mode` argument - or where untrusted content embedded in a `<webview>` element can invoke `openDevTools()` - are exposed to full Node.js-level code execution on the host operating system. No public exploit has been identified at time of analysis, but Electron's own GitHub Security Advisory (GHSA-4f78-qhmw-8j8m) confirms the flaw and vendor-released patches are available across all active release tracks.
Session isolation bypass in Electron's custom protocol handler allows cached HTTP responses from defaultSession to leak across otherwise isolated session partitions. Electron versions 40.x through pre-release 43.x are affected when apps use ProtocolResponse.url without specifying ProtocolResponse.session, causing upstream requests to be routed through defaultSession regardless of which session registered the protocol handler. An attacker who can trigger a cross-session cache hit may read confidential session-scoped content (C:H) or partially influence cached responses (I:L) intended for a different, isolated session; no public exploit or CISA KEV listing exists at time of analysis.
Unrestricted HTTP redirect scheme following in Electron's net module (versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3) enables server-side request forgery leading to local file disclosure. When net.fetch() or net.request() follows a redirect issued by an attacker-controlled server targeting a local scheme such as file://, the Electron app can be made to read and expose local filesystem contents if it forwards or returns the response body. No public exploit is identified at time of analysis; however, the vulnerability class (SSRF via redirect scheme bypass, CWE-918) is well understood, and the default redirect-following behavior increases the practical surface area across affected apps.
Path validation bypass in Electron's shell.openPath() allows an attacker-controlled file to be opened in place of one that passed string-based extension validation, due to embedded null bytes not being rejected before OS-level path resolution. Electron-based desktop applications that accept untrusted file paths, validate them using only JavaScript string methods (e.g., endsWith(), regex extension checks), and then pass them to shell.openPath() are affected; apps using Node.js fs APIs (fs.existsSync(), fs.stat()) prior to the call are explicitly not vulnerable. Fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1; no public exploit identified at time of analysis.
Session isolation bypass in Electron allows a malicious or compromised Chrome extension loaded into one session to cross session boundaries and access, navigate, and script windows belonging to a completely separate session. Affected are Electron applications prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 that invoke session.loadExtension and rely on multi-session architecture as a security boundary - a narrowly scoped but architecturally significant trust boundary violation. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires attacker control of an extension the application has explicitly loaded.
Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-based hardening controls restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS, injecting code inside the signed Electron application and inheriting its TCC permissions and keychain access. Only macOS deployments of Electron apps that have explicitly enabled same-signed-parent fuse restrictions are exposed; applications without this hardening are unaffected. No public exploit has been identified at time of analysis, and CVSS AC:H reflects the PID-reuse race-condition timing requirement inherent to the attack.
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity (CVSS 9.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.