Packages / electron / Security

HighVulnerabilityGHSA-gvcj-pfq2-wxj7CVE-2016-1202Published 24 Oct 2017

High severity vulnerability that affects electron

Affected releases · electron

  • 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated

0.4.x has no fix yet; the newest fixed line:

npm install electron@0.33.5
45.x

  1. Not affected

    45.0.0

    1 release, latest

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.