~ / search / GHSA-m93v-9qjc-3g79

GHSA-m93v-9qjc-3g79

Context isolation bypass via leaked cross-context objects in Electron

Source: GitHub Advisory Database (reviewed) High CVE-2020-4076

Packages

EcosystemPackageAffectedFixed in
npm electron < 7.2.4 7.2.4
npm electron >= 8.0.0, < 8.2.4 8.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Apps using `contextIsolation` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. ### Workarounds There are no app-side workarounds, you must update your Electron version to be protected. ### Fixed Versions * `9.0.0-beta.21` * `8.2.4` * `7.2.4` ### Non-Impacted Versions * `9.0.0-beta.*` ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.