GitHub Advisoryadvisory · npm

GHSA-6vrv-94jv-crrg Context isolation bypass via Promise in Electron

LOW Published 2020-07-07 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-15096
Ecosystem
npm
Packages
electron
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-501
Reviewed
2020-07-06

Affected packages

• npm electron: < 6.1.11 → fixed in 6.1.11 • npm electron: >= 7.0.0, < 7.2.4 → fixed in 7.2.4 • npm electron: >= 8.0.0, < 8.2.4 → fixed in 8.2.4

Description

Impact Apps using `contextIsolation` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions • `9.0.0-beta.21` • `8.2.4` • `7.2.4` • `6.1.11` For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-15096 In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the… vulnerability

Weakness · CWE (1)

  • CWE-501 Trust Boundary Violation weakness

References