GHSA-34h3-8mw4-qw57
@electron/packager's build process memory potentially leaked into final executable
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @electron/packager | >= 18.3.0, < 18.3.1 | 18.3.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc.
### Patches
This issue is patched in 18.3.1
### Workarounds
No workarounds, please update to a patched version of `@electron/packager` immediately if impacated.
References
External links from the advisory. They lead to third-party sites.