Packages / electron / Security

LowVulnerabilityGHSA-56pc-6jqp-xqj8CVE-2020-15215Published 6 Oct 2020

Context isolation bypass in Electron

Affected releases · electron

  • 10.x10.0.0 – 10.1.1Fixed in 10.1.2
  • 9.x9.0.0 – 9.3.0Fixed in 9.3.1
  • 8.x8.0.0 – 8.5.1Fixed in 8.5.2

On 10.x, the newest line:

npm install electron@10.1.2
45.x

  1. Not affected

    45.0.0

    1 release, latest

10.x

  1. Affected

    10.0.0 – 10.1.1

    4 releases

  2. Fixed

    10.1.2 – 10.4.7

    18 releases

9.x

  1. Affected

    9.0.0 – 9.3.0

    12 releases

  2. Fixed

    9.3.1 – 9.4.4

    10 releases

8.x

  1. Affected

    8.0.0 – 8.5.1

    21 releases

  2. Fixed

    8.5.2 – 8.5.5

    4 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nativeWindowOpen: true are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Workarounds

There are no app-side workarounds, you must update your Electron version to be protected.

Fixed Versions

  • 11.0.0-beta.6

  • 10.1.2

  • 9.3.1

  • 8.5.2

For more information

If you have any questions or comments about this advisory:

  • Email us at security@electronjs.org