Packages / electron / Security

ModerateVulnerabilityGHSA-mpjm-v997-c4h4CVE-2021-39184Published 12 Oct 2021

Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Affected releases · electron

  • 13.x13.0.0 – 13.2.3Fixed in 13.3.0
  • 12.x12.0.0 – 12.0.18Fixed in 12.1.0
  • 11.x11.0.0 – 11.4.12Fixed in 11.5.0
  • 10.x and older0.1.0 – 10.4.7No fix, no longer updated

On 13.x, the newest line:

npm install electron@13.3.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

13.x

  1. Affected

    13.0.0 – 13.2.3

    16 releases

  2. Fixed

    13.3.0 – 13.6.9

    13 releases

12.x

  1. Affected

    12.0.0 – 12.0.18

    19 releases

  2. Fixed

    12.1.0 – 12.2.3

    7 releases

11.x

  1. Affected

    11.0.0 – 11.4.12

    26 releases

  2. Fixed

    11.5.0

    1 release

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases.

All current stable versions of Electron are affected.

Patches

This was fixed with #30728, and the following Electron versions contain the fix:

  • 15.0.0-alpha.10

  • 14.0.0

  • 13.3.0

  • 12.1.0

  • 11.5.0

Workarounds

If your app enables contextIsolation, this vulnerability is significantly more difficult for an attacker to exploit.

Further, if your app does not depend on the createThumbnailFromPath API, then you can simply disable the functionality. In the main process, before the 'ready' event:

delete require('electron').nativeImage.createThumbnailFromPath

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.