Packages / electron / Security

ModerateVulnerabilityGHSA-6h98-cf9g-vmg2CVE-2017-1000424Published 13 May 2022

Electron vulnerable to URL spoofing via PDFium

Affected releases · electron

  • 1.x1.7.0 – 1.7.5Fixed in 1.7.6

On 1.x, the newest line:

npm install electron@1.7.6
45.x

  1. Not affected

    45.0.0

    1 release, latest

1.x

  1. Not affected

    1.3.1 – 1.6.18

    53 releases

  2. Affected

    1.7.0 – 1.7.5

    6 releases

  3. Fixed

    1.7.6 – 1.8.8

    20 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.