GitHub Advisoryadvisory · npm

GHSA-h9jc-284h-533g Context isolation bypass via contextBridge in Electron

HIGH Published 2020-07-07 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-4077
Ecosystem
npm
Packages
electron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-501
Reviewed
2020-07-06

Affected packages

• npm electron: < 7.2.4 → fixed in 7.2.4 • npm electron: >= 8.0.0, < 8.2.4 → fixed in 8.2.4

Description

Impact Apps using both `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your Electron version to be protected. Fixed Versions • `9.0.0-beta.21` • `8.2.4` • `7.2.4` For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-4077 In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. vulnerability

Weakness · CWE (1)

  • CWE-501 Trust Boundary Violation weakness

References