PT-2020-17865 · Electron · Electron

Marshallofsound · Published 2020-07-07 · Updated 2020-07-13 · CVE-2020-4076

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21

Description The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions. This affects apps using contextIsolation.

Recommendations For Electron versions prior to 7.2.4, update to version 7.2.4 or later. For Electron versions prior to 8.2.4, update to version 8.2.4 or later. For Electron versions prior to 9.0.0-beta21, update to version 9.0.0-beta21 or later.

Fix

Weakness Enumeration

CWE-501

Related Identifiers

CVE-2020-4076

GHSA-M93V-9QJC-3G79

Affected Products

Electron

References · 6

• https://electronjs.org/releases/stable?page=3#release-notes-for-v824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4076 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4076 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m93v-9qjc-3g79 · Vendor Advisory
• https://github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79 · Note
• https://t.me/cvenotify/4891 · Telegram Post