GHSA-6h98-cf9g-vmg2

Electron vulnerable to URL spoofing via PDFium

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000424

Packages

Ecosystem	Package	Affected	Fixed in
npm	electron	>= 1.7.0, < 1.7.6	1.7.6

Details

As written in the advisory (Markdown source, shown as plain text).

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000424 advisory
https://github.com/electron/electron/pull/10008 web
https://github.com/electron/electron/pull/10008/files web
https://github.com/electron/electron package
https://github.com/electron/electron/releases/tag/v1.7.6 web