GitHub Advisoryadvisory · npm

GHSA-f9mq-jph6-9mhm Arbitrary file read via window-open IPC in Electron

MEDIUM Published 2020-07-07 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-4075
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-552
Reviewed
2020-07-06

Affected packages

• npm electron: < 7.2.4 → fixed in 7.2.4 • npm electron: >= 8.0.0, < 8.2.4 → fixed in 8.2.4

Description

Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. Workarounds Ensure you are calling `event.preventDefault()` on all `new-window` events where the `url` or `options` is not something you expect. Fixed Versions • `9.0.0-beta.21` • `8.2.4` • `7.2.4` For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-4075 In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a… vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References