Packages / electron / Security

ModerateVulnerabilityGHSA-f9mq-jph6-9mhmCVE-2020-4075Published 7 Jul 2020

Arbitrary file read via window-open IPC in Electron

Affected releases · electron

  • 8.x8.0.0 – 8.2.3Fixed in 8.2.4
  • 7.x7.0.0 – 7.2.3Fixed in 7.2.4
  • 6.x and older0.1.0 – 6.1.12No fix, no longer updated

On 8.x, the newest line:

npm install electron@8.2.4
45.x

  1. Not affected

    45.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.2.3

    10 releases

  2. Fixed

    8.2.4 – 8.5.5

    15 releases

7.x

  1. Affected

    7.0.0 – 7.2.3

    21 releases

  2. Fixed

    7.2.4 – 7.3.3

    5 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

Workarounds

Ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect.

Fixed Versions

  • 9.0.0-beta.21

  • 8.2.4

  • 7.2.4

For more information

If you have any questions or comments about this advisory:

  • Email us at security@electronjs.org