Packages / electron / Security

LowVulnerabilityGHSA-6vrv-94jv-crrgCVE-2020-15096Published 7 Jul 2020

Context isolation bypass via Promise in Electron

Affected releases · electron

  • 8.x8.0.0 – 8.2.3Fixed in 8.2.4
  • 7.x7.0.0 – 7.2.3Fixed in 7.2.4
  • 6.x6.0.0 – 6.1.10Fixed in 6.1.11
  • 5.x and older0.1.0 – 5.0.13No fix, no longer updated

On 8.x, the newest line:

npm install electron@8.2.4
45.x

  1. Not affected

    45.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.2.3

    10 releases

  2. Fixed

    8.2.4 – 8.5.5

    15 releases

7.x

  1. Affected

    7.0.0 – 7.2.3

    21 releases

  2. Fixed

    7.2.4 – 7.3.3

    5 releases

6.x

  1. Affected

    6.0.0 – 6.1.10

    24 releases

  2. Fixed

    6.1.11 – 6.1.12

    2 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Apps using contextIsolation are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Workarounds

There are no app-side workarounds, you must update your Electron version to be protected.

Fixed Versions

  • 9.0.0-beta.21

  • 8.2.4

  • 7.2.4

  • 6.1.11

For more information

If you have any questions or comments about this advisory:

  • Email us at security@electronjs.org