GHSA-vmqv-hx8q-j7mg Electron has ASAR Integrity Bypass via resource modification

• npm electron: < 35.7.5 → fixed in 35.7.5 • npm electron: >= 36.0.0-alpha.1, < 36.8.1 → fixed in 36.8.1 • npm electron: >= 37.0.0-alpha.1, < 37.3.1 → fixed in 37.3.1 • npm electron: >= 38.0.0-alpha.1, < 38.0.0-beta.6 → fixed in 38.0.0-beta.6

Impact This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against. Workarounds There are no app side workarounds, you must update to a patched version of Electron. Fixed Versions • `38.0.0-beta.6` • `37.3.1` • `36.8.1` • `35.7.5` For more information If you have any questions or comments about this advisory, email us at [email protected]