~ / search / GHSA-6vrv-94jv-crrg

GHSA-6vrv-94jv-crrg

Context isolation bypass via Promise in Electron

Source: GitHub Advisory Database (reviewed) Low CVE-2020-15096

Packages

EcosystemPackageAffectedFixed in
npm electron < 6.1.11 6.1.11
npm electron >= 7.0.0, < 7.2.4 7.2.4
npm electron >= 8.0.0, < 8.2.4 8.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Apps using `contextIsolation` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. ### Workarounds There are no app-side workarounds, you must update your Electron version to be protected. ### Fixed Versions * `9.0.0-beta.21` * `8.2.4` * `7.2.4` * `6.1.11` ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.