Marshallofsound

**Name of the Vulnerable Software and Affected Versions** Electron Packager versions prior to 18.3.1 **Description** A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc. **Recommendations** For versions prior to 18.3.1, update to version 18.3.1 to resolve the issue. As a temporary workaround, consider avoiding the use of sensitive information in the application source code until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 22.3.24 Electron versions prior to 24.8.3 Electron versions prior to 25.8.1 Electron versions prior to 26.2.1 Electron versions prior to 27.0.0-alpha.7 **Description** This issue impacts Electron apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled, specifically on macOS where these fuses are currently supported. The issue can be exploited if the app is launched from a filesystem that an attacker has write access to, allowing them to edit files inside the `.app` bundle, which these fuses are supposed to protect against. **Recommendations** For Electron versions prior to 22.3.24, update to version 22.3.24 or later. For Electron versions prior to 24.8.3, update to version 24.8.3 or later. For Electron versions prior to 25.8.1, update to version 25.8.1 or later. For Electron versions prior to 26.2.1, update to version 26.2.1 or later. For Electron versions prior to 27.0.0-alpha.7, update to version 27.0.0-alpha.7 or later.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 22.3.6 Electron versions prior to 23.2.3 Electron versions prior to 24.0.1 Electron versions prior to 25.0.0-alpha.2 **Description** Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML, and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected by a context isolation bypass issue. This means that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. The issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a JavaScript object which cannot be serialized, such as a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. **Recommendations** For versions prior to 22.3.6, update to version 22.3.6 or later. For versions prior to 23.2.3, update to version 23.2.3 or later. For versions prior to 24.0.1, update to version 24.0.1 or later. For versions prior to 25.0.0-alpha.2, update to version 25.0.0-alpha.2 or later. As a temporary workaround, ensure that all values returned from a function exposed over the `contextBridge` are supported and that any objects returned from functions do not have dynamic getters that can throw exceptions.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5 **Description** The issue is related to the `nodeIntegrationInSubFrames` parameter in Electron, which can lead to information disclosure. A renderer with JavaScript execution can obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled, allowing effective access to `ipcRenderer`. This access can compromise the application or user if the application exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data. **Recommendations** For versions prior to 18.0.0-beta.6, update to version 18.0.0-beta.6 or later. For versions prior to 17.2.0, update to version 17.2.0 or later. For versions prior to 16.2.6, update to version 16.2.6 or later. For versions prior to 15.5.5, update to version 15.5.5 or later. As a temporary workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5 **Description** A vulnerability in Electron allows attackers who have control over a given app's update server or update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto-updating infrastructure, and the ease of that attack entirely depends on the potential victim's infrastructure security. **Recommendations** Update to Electron version 18.0.0-beta.6 or later Update to Electron version 17.2.0 or later Update to Electron version 16.2.6 or later Update to Electron version 15.5.5 or later There are no known workarounds for this issue, so updating to a patched version of Electron is necessary.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 17.0.0-alpha.6 Electron versions prior to 16.0.6 Electron versions prior to 15.3.5 Electron versions prior to 14.2.4 Electron versions prior to 13.6.6 **Description** A vulnerability in Electron allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device. All current stable versions of Electron are affected. **Recommendations** For versions prior to 17.0.0-alpha.6, update to version 17.0.0-alpha.6 or later. For versions prior to 16.0.6, update to version 16.0.6 or later. For versions prior to 15.3.5, update to version 15.3.5 or later. For versions prior to 14.2.4, update to version 14.2.4 or later. For versions prior to 13.6.6, update to version 13.6.6 or later. As a temporary workaround, consider adding the code to prevent default behavior and cancel the request for the `select-bluetooth-device` event handler.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 11.5.0 Electron versions prior to 12.1.0 Electron versions prior to 13.3.0 **Description** A vulnerability in Electron allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. This issue is related to the `createThumbnailFromPath` API and can lead to the disclosure of protected information. **Recommendations** For versions prior to 11.5.0, consider upgrading to version 11.5.0 or later. For versions prior to 12.1.0, consider upgrading to version 12.1.0 or later. For versions prior to 13.3.0, consider upgrading to version 13.3.0 or later. As a temporary workaround, consider enabling `contextIsolation` in your app to make the vulnerability significantly more difficult for an attacker to exploit. If your app does not depend on the `createThumbnailFromPath` API, consider disabling the functionality by deleting `require('electron').nativeImage.createThumbnailFromPath` in the main process before the 'ready' event.

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 9.4.0 Electron versions prior to 10.2.0 Electron versions prior to 11.1.0 Electron versions prior to 12.0.0-beta.9 Description: IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply`, or when using the `remote` module, can in some cases be delivered to the wrong frame. If an app uses `remote`, calls `webContents.sendToFrame`, or calls `event.reply` in an IPC message handler, then it is impacted by this issue. Recommendations: For versions prior to 9.4.0, update to version 9.4.0 or later. For versions prior to 10.2.0, update to version 10.2.0 or later. For versions prior to 11.1.0, update to version 11.1.0 or later. For versions prior to 12.0.0-beta.9, update to version 12.0.0-beta.9 or later. As a temporary workaround, consider avoiding the use of `remote`, `webContents.sendToFrame`, and `event.reply` in IPC message handlers until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 11.0.0-beta.1 Electron versions prior to 10.0.1 Electron versions prior to 9.3.0 Electron versions prior to 8.5.1 **Description** The `will-navigate` event can be bypassed when a sub-frame performs a top-frame navigation across sites. This issue can be exploited to bypass navigation restrictions. As a workaround, sandboxing all iframes using the `sandbox` attribute can prevent them from creating top-frame navigations. **Recommendations** For versions prior to 11.0.0-beta.1, update to version 11.0.0-beta.1 or later. For versions prior to 10.0.1, update to version 10.0.1 or later. For versions prior to 9.3.0, update to version 9.3.0 or later. For versions prior to 8.5.1, update to version 8.5.1 or later. As a temporary workaround, consider sandboxing all iframes using the `sandbox` attribute to prevent them from creating top-frame navigations.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 11.0.0-beta.6 Electron versions prior to 10.1.2 Electron versions prior to 9.3.1 Electron versions prior to 8.5.2 **Description** This issue is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `sandbox: true` are affected, as well as apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` or `nativeWindowOpen: true`. **Recommendations** Update to version 11.0.0-beta.6 or later to resolve the issue. Update to version 10.1.2 or later to resolve the issue. Update to version 9.3.1 or later to resolve the issue. Update to version 8.5.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 **Description** The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions. This affects apps using `contextIsolation`. **Recommendations** For Electron versions prior to 7.2.4, update to version 7.2.4 or later. For Electron versions prior to 8.2.4, update to version 8.2.4 or later. For Electron versions prior to 9.0.0-beta21, update to version 9.0.0-beta21 or later.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 **Description** The issue allows for arbitrary local file read by defining unsafe window options on a child window opened via window.open. To mitigate this, ensure that `event.preventDefault()` is called on all new-window events where the `url` or `options` is not expected. **Recommendations** For versions prior to 7.2.4, 8.2.4, and 9.0.0-beta21, update to version 7.2.4, 8.2.4, or 9.0.0-beta21 respectively to resolve the issue. As a temporary workaround, consider calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 **Description** The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions. This affects apps using both `contextIsolation` and `contextBridge`. **Recommendations** For versions prior to 7.2.4, update to version 7.2.4 or later. For versions prior to 8.2.4, update to version 8.2.4 or later. For versions prior to 9.0.0-beta21, update to version 9.0.0-beta21 or later.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 6.1.1 Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21 **Description** The issue is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using `contextIsolation` are affected. There are no app-side workarounds. **Recommendations** For Electron versions prior to 6.1.1, update to version 6.1.1 or later to be protected. For Electron versions prior to 7.2.4, update to version 7.2.4 or later to be protected. For Electron versions prior to 8.2.4, update to version 8.2.4 or later to be protected. For Electron versions prior to 9.0.0-beta21, update to version 9.0.0-beta21 or later to be protected.

Name of the Vulnerable Software and Affected Versions: Github Electron versions 1.8.2-beta.4 and earlier Description: The issue is related to a Command Injection vulnerability in the Protocol Handler of Github Electron. This vulnerability can be exploited when a victim opens an Electron protocol handler in their browser, potentially allowing an attacker to execute commands. The vulnerability is due to an incomplete fix, specifically because the blacklist used was not case insensitive, allowing an attacker to potentially bypass it. Recommendations: For Github Electron versions 1.8.2-beta.4 and earlier, update to Electron 1.8.2-beta.5 or later to resolve the issue.