GitHub Advisoryadvisory · npm

GHSA-hvf8-h2qh-37m9 IPC messages delivered to the wrong frame in Electron

MEDIUM Published 2021-01-28 Modified 2025-05-27 Official page ↗
Aliases
CVE-2020-26272
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-668
Reviewed
2021-01-28

Affected packages

• npm electron: < 9.4.0 → fixed in 9.4.0 • npm electron: >= 10.0.0, < 10.2.0 → fixed in 10.2.0 • npm electron: >= 11.0.0, < 11.1.0 → fixed in 11.1.0

Description

Impact IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame. If your app does ANY of the following, then it is impacted by this issue: • Uses `remote` • Calls `webContents.sendToFrame` • Calls `event.reply` in an IPC message handler Patches This has been fixed in the following versions: • 9.4.0 • 10.2.0 • 11.1.0 • 12.0.0-beta.9 Workarounds There are no workarounds for this issue. For more information If you have any questions or comments about this advisory, email us at [email protected].

Related

Alias · CVE (1)

  • CVE-2020-26272 The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References