~ / search / GHSA-vmqv-hx8q-j7mg

GHSA-vmqv-hx8q-j7mg

Electron has ASAR Integrity Bypass via resource modification

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-55305

Packages

EcosystemPackageAffectedFixed in
npm electron < 35.7.5 35.7.5
npm electron >= 36.0.0-alpha.1, < 36.8.1 36.8.1
npm electron >= 37.0.0-alpha.1, < 37.3.1 37.3.1
npm electron >= 38.0.0-alpha.1, < 38.0.0-beta.6 38.0.0-beta.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled. Apps without these fuses enabled are not impacted. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `38.0.0-beta.6` * `37.3.1` * `36.8.1` * `35.7.5` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.