GHSA-f9mq-jph6-9mhmMediumCVSS 6.8

Arbitrary file read via window-open IPC in Electron

Published
July 7, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-4075 →

📋 Description

Impact

The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

Workarounds

Ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect.

Fixed Versions

  • 9.0.0-beta.21
  • 8.2.4
  • 7.2.4

For more information

If you have any questions or comments about this advisory:

🎯 Affected products2

  • npm/electron:>= 8.0.0, < 8.2.4
  • npm/electron:< 7.2.4

🔗 References (4)