GitHub Advisoryadvisory · npm

GHSA-56pc-6jqp-xqj8 Context isolation bypass in Electron

LOW Published 2020-10-06 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-15215
Ecosystem
npm
Packages
electron
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-668, CWE-693
Reviewed
2020-10-06

Affected packages

• npm electron: >= 8.0.0-beta.0, < 8.5.2 → fixed in 8.5.2 • npm electron: >= 9.0.0-beta.0, < 9.3.1 → fixed in 9.3.1 • npm electron: >= 10.0.0-beta.0, < 10.1.2 → fixed in 10.1.2 • npm electron: >= 11.0.0-beta.0, < 11.0.0-beta.6 → fixed in 11.0.0-beta.6

Description

Impact Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nativeWindowOpen: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions • `11.0.0-beta.6` • `10.1.2` • `9.3.1` • `8.5.2` For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-15215 Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. vulnerability

Weakness · CWE (2)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-693 Protection Mechanism Failure weakness

References