GHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

• npm electron: < 38.8.6 → fixed in 38.8.6 • npm electron: >= 39.0.0-alpha.1, < 39.8.3 → fixed in 39.8.3 • npm electron: >= 40.0.0-alpha.1, < 40.8.3 → fixed in 40.8.3 • npm electron: >= 41.0.0-alpha.1, < 41.0.3 → fixed in 41.0.3

Impact Apps that register custom protocol handlers via `protocol.handle()` / `protocol.registerSchemesAsPrivileged()` or modify response headers via `webRequest.onHeadersReceived` may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. Workarounds Validate or sanitize any untrusted input before including it in a response header name or value. Fixed Versions • `41.0.3` • `40.8.3` • `39.8.3` • `38.8.6` For more information If there are any questions or comments about this advisory, send an email to [email protected]