Packages / electron / Security

HighVulnerabilityGHSA-j7hp-h8jx-5pprA-299477569ASB-A-299477569CVE-2023-4863CVE-2023-5129PYSEC-2026-1794RUSTSEC-2023-0060RUSTSEC-2023-0061Published 12 Sep 2023

libwebp: OOB write in BuildHuffmanTable

Affected releases · electron

  • 26.x26.0.0 – 26.2.0Fixed in 26.2.1
  • 25.x25.0.0 – 25.8.0Fixed in 25.8.1
  • 24.x24.0.0 – 24.8.2Fixed in 24.8.3
  • 22.x22.0.0 – 22.3.23Fixed in 22.3.24

On 26.x, the newest line:

npm install electron@26.2.1
45.x

  1. Not affected

    45.0.0

    1 release, latest

26.x

  1. Affected

    26.0.0 – 26.2.0

    3 releases

  2. Fixed

    26.2.1 – 26.6.10

    21 releases

25.x

  1. Affected

    25.0.0 – 25.8.0

    13 releases

  2. Fixed

    25.8.1 – 25.9.8

    13 releases

24.x

  1. Affected

    24.0.0 – 24.8.2

    23 releases

  2. Fixed

    24.8.3 – 24.8.8

    6 releases

22.x

  1. Affected

    22.0.0 – 22.3.23

    29 releases

  2. Fixed

    22.3.24 – 22.3.27

    4 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.