Packages / electron / Security

HighVulnerabilityGHSA-2q4g-w47c-4674CVE-2020-15174Published 6 Oct 2020

Unpreventable top-level navigation

Affected releases · electron

  • 10.x10.0.0Fixed in 10.0.1
  • 9.x9.0.0 – 9.2.1Fixed in 9.3.0
  • 8.x8.0.0 – 8.5.0Fixed in 8.5.1

On 10.x, the newest line:

npm install electron@10.0.1
45.x

  1. Not affected

    45.0.0

    1 release, latest

10.x

  1. Affected

    10.0.0

    1 release

  2. Fixed

    10.0.1 – 10.4.7

    21 releases

9.x

  1. Affected

    9.0.0 – 9.2.1

    11 releases

  2. Fixed

    9.3.0 – 9.4.4

    11 releases

8.x

  1. Affected

    8.0.0 – 8.5.0

    20 releases

  2. Fixed

    8.5.1 – 8.5.5

    5 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

The will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites.

Patches

  • 11.0.0-beta.1

  • 10.0.1

  • 9.3.0

  • 8.5.1

Workarounds

Sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

For more information

If you have any questions or comments about this advisory:

  • Email us at security@electronjs.org