GHSA-56pc-6jqp-xqj8
Context isolation bypass in Electron
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Apps using both `contextIsolation` and `sandbox: true` are affected.
Apps using both `contextIsolation` and `nativeWindowOpen: true` are affected.
This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.
### Fixed Versions
* `11.0.0-beta.6`
* `10.1.2`
* `9.3.1`
* `8.5.2`
### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.