Packages / electron / Security

ModerateVulnerabilityGHSA-7x97-j373-85x5CVE-2023-39956Published 6 Sep 2023

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

Affected releases · electron

  • 25.x25.0.0 – 25.4.0Fixed in 25.5.0
  • 24.x24.0.0 – 24.7.0Fixed in 24.7.1
  • 23.x23.0.0 – 23.3.12Fixed in 23.3.13
  • 22.x22.0.0 – 22.3.18Fixed in 22.3.21
  • 21.x and older0.1.0 – 21.4.4No fix, no longer updated

On 25.x, the newest line:

npm install electron@25.5.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

25.x

  1. Affected

    25.0.0 – 25.4.0

    9 releases

  2. Fixed

    25.5.0 – 25.9.8

    17 releases

24.x

  1. Affected

    24.0.0 – 24.7.0

    19 releases

  2. Fixed

    24.7.1 – 24.8.8

    10 releases

23.x

  1. Affected

    23.0.0 – 23.3.12

    24 releases

  2. Fixed

    23.3.13

    1 release

22.x

  1. Affected

    22.0.0 – 22.3.18

    26 releases

  2. Fixed

    22.3.21 – 22.3.27

    7 releases

21.x

  1. Affected

    21.0.0 – 21.4.4

    18 releases

20.x

  1. Affected

    20.0.0 – 20.3.12

    23 releases

19.x

  1. Affected

    19.0.0 – 19.1.9

    28 releases

18.x

  1. Affected

    18.0.0 – 18.3.15

    25 releases

17.x

  1. Affected

    17.0.0 – 17.4.11

    20 releases

16.x

  1. Affected

    16.0.0 – 16.2.8

    22 releases

15.x

  1. Affected

    15.0.0 – 15.5.7

    24 releases

14.x

  1. Affected

    14.0.0 – 14.2.9

    15 releases

13.x

  1. Affected

    13.0.0 – 13.6.9

    29 releases

12.x

  1. Affected

    12.0.0 – 12.2.3

    26 releases

11.x

  1. Affected

    11.0.0 – 11.5.0

    27 releases

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help

Specifically this issue can only be exploited if the following conditions are met:

  • Your app is launched with an attacker-controlled working directory

  • The attacker has the ability to write files to that working directory

This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 26.0.0-beta.13

  • 25.5.0

  • 24.7.1

  • 23.3.13

  • 22.3.19

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org