Packages / electron / Security

HighVulnerabilityGHSA-h9jc-284h-533gCVE-2020-4077Published 7 Jul 2020

Context isolation bypass via contextBridge in Electron

Affected releases · electron

  • 8.x8.0.0 – 8.2.3Fixed in 8.2.4
  • 7.x7.0.0 – 7.2.3Fixed in 7.2.4
  • 6.x and older0.1.0 – 6.1.12No fix, no longer updated

On 8.x, the newest line:

npm install electron@8.2.4
45.x

  1. Not affected

    45.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.2.3

    10 releases

  2. Fixed

    8.2.4 – 8.5.5

    15 releases

7.x

  1. Affected

    7.0.0 – 7.2.3

    21 releases

  2. Fixed

    7.2.4 – 7.3.3

    5 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Apps using both contextIsolation and contextBridge are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

Workarounds

There are no app-side workarounds, you must update your Electron version to be protected.

Fixed Versions

  • 9.0.0-beta.21

  • 8.2.4

  • 7.2.4

For more information

If you have any questions or comments about this advisory:

  • Email us at security@electronjs.org