electron vulnerabilities (npm)
80 vulnerabilities.
-
electronnpm Electron: Mitigation for compromised eMudhra intermediate certificates 7.4 High -
electronnpm Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry 3.9 Low -
electronnpm Electron: Frame subscription trusts GPU-supplied frame geometry 3.9 Low -
electronnpm Electron: openExternal permission requests can be attributed to the wrong origin 5.4 Medium -
electronnpm Electron: HID and USB permission checks can be attributed to the wrong origin 5.4 Medium -
electronnpm Electron: Pointer lock permission requests can be attributed to the wrong frame 5.4 Medium -
electronnpm Electron: Extension tabs.query returns tab URLs and titles without the tabs permission 3.1 Low -
electronnpm Electron: SameSite cookie restrictions are not applied to windows opened from links 4.2 Medium -
electronnpm Electron: Local race condition in Squirrel.Mac update installation on macOS 6.7 Medium -
electronnpm Electron: Sandboxed preload code cache can be poisoned by a compromised renderer 7.8 High -
electronnpm Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions 8.3 High -
electronnpm Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled 7.4 High -
electronnpm Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions 8.2 High -
electronnpm Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab 8.2 High -
electronnpm Electron: Sandboxed iframes can launch external protocol handlers 5.4 Medium -
electronnpm Electron: DevTools embedder handler executes arbitrary files via shell open 6.9 Medium -
electronnpm Electron: contextBridge object copy honors prototype setters 5.4 Medium -
electronnpm Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter 5.7 Medium -
electronnpm Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path 7.2 High -
electronnpm Electron: window.open features string controls some window options considered privileged 5.3 Medium -
electronnpm Electron: ProtocolResponse.url reuses the default session cache instead of the registering session 5.9 Medium -
electronnpm Electron: HTTP redirect followed into local file loader 5.9 Medium -
electronnpm Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads 7.4 High -
electronnpm Electron: shell.openPath path validation bypass via embedded null byte 6.0 Medium -
electronnpm Electron: Extension tab APIs operate across session boundaries 6.6 Medium -
electronnpm Electron: Context isolation bypass via Function.prototype.bind hijack 7.5 High -
electronnpm Electron: Cross-origin iframe can position native autofill popup 3.1 Low -
electronnpm Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin 5.9 Medium -
electronnpm Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size 3.9 Low -
electronnpm Electron: Parent process code-sign check is spoofable 6.3 Medium -
electronnpm Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow 9.3 Critical -
electronnpm Electron crashes in clipboard.readImage() on malformed clipboard image data 2.8 Low -
electronnpm Electron named window.open targets not scoped to the opener's browsing context 6.0 Medium -
electronnpm Electron has a use-after-free in offscreen shared texture release() callback 2.3 Low -
electronnpm Electron: Context Isolation bypass via contextBridge VideoFrame transfer 8.4 High -
electronnpm Electron: AppleScript injection in app.moveToApplicationsFolder on macOS 6.5 Medium -
electronnpm Electron: Service worker can spoof executeJavaScript IPC replies 5.9 Medium -
electronnpm Electron: Incorrect origin passed to permission request handler for iframe requests 5.4 Medium -
electronnpm Electron: Out-of-bounds read in second-instance IPC on macOS and Linux 5.3 Medium -
electronnpm Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes 6.8 Medium -
electronnpm Electron: Use-after-free in offscreen child window paint callback 8.1 High -
electronnpm Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows 4.7 Medium -
electronnpm Electron: Use-after-free in download save dialog callback 5.8 Medium -
electronnpm Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks 7.5 High -
electronnpm Electron: Use-after-free in PowerMonitor on Windows and macOS 7.0 High -
electronnpm Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference 7.8 High -
electronnpm Electron: Unquoted executable path in app.setLoginItemSettings on Windows 3.9 Low -
electronnpm Electron: HTTP Response Header Injection in custom protocol handlers and webRequest 5.9 Medium -
electronnpm Electron: USB device selection not validated against filtered device list 3.3 Low -
electronnpm Electron is vulnerable to Code Injection via resource modification 6.1 Medium - Show olderLoading…