~ / search / GHSA-f9mq-jph6-9mhm

GHSA-f9mq-jph6-9mhm

Arbitrary file read via window-open IPC in Electron

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-4075

Packages

EcosystemPackageAffectedFixed in
npm electron < 7.2.4 7.2.4
npm electron >= 8.0.0, < 8.2.4 8.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. ### Workarounds Ensure you are calling `event.preventDefault()` on all [`new-window`](https://electronjs.org/docs/api/web-contents#event-new-window) events where the `url` or `options` is not something you expect. ### Fixed Versions * `9.0.0-beta.21` * `8.2.4` * `7.2.4` ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.