GHSA-h9jc-284h-533g

Context isolation bypass via contextBridge in Electron

Source: GitHub Advisory Database (reviewed) High CVE-2020-4077

Packages

Ecosystem	Package	Affected	Fixed in
npm	electron	< 7.2.4	7.2.4
npm	electron	>= 8.0.0, < 8.2.4	8.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Apps using both `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. ### Workarounds There are no app-side workarounds, you must update your Electron version to be protected. ### Fixed Versions * `9.0.0-beta.21` * `8.2.4` * `7.2.4` ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.

https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g web
https://nvd.nist.gov/vuln/detail/CVE-2020-4077 advisory
https://github.com/electron/electron/commit/b8e347709245d2dc5640fbb3044d9b21b4eaa6b0 web
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 web