CVE-2022-29247

🗓️ 13 Jun 2022 21:05:10Reported by MendType

Renderer with JS execution in Electron can access ipcRenderer via nodeIntegrationInSubFrames.

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module (CVE-2022-29247, CVE-2022-36077)	12 Dec 202209:16	–	ibm
BDU FSTEC	The vulnerability of the `nodeIntegrationInSubFrames` parameter in the software platform for creating Electron applications allows a hacker to disclose protected information.	19 Aug 202200:00	–	bdu_fstec
Circl	CVE-2022-29247	14 Jun 202200:17	–	circl
CNNVD	Electron 安全漏洞	13 Jun 202200:00	–	cnnvd
CVE	CVE-2022-29247	13 Jun 202221:05	–	cve
Cvelist	CVE-2022-29247 Exposure of Resource to Wrong Sphere in Electron	13 Jun 202221:05	–	cvelist
EUVD	EUVD-2022-6098	3 Oct 202520:07	–	euvd
Github Security Blog	Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled	16 Jun 202223:14	–	github
NVD	CVE-2022-29247	13 Jun 202221:15	–	nvd
OSV	GHSA-MQ8J-3H7H-P8G7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled	16 Jun 202223:14	–	osv

Vulners

Node

electronjs electronRange18.0.0-beta.1–18.0.0-beta.6

electronjs electronRange0.1.0–15.5.5

electronjs electronRange16.0.0–16.2.6

electronjs electronRange17.0.0–17.2.0

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29247.json
github	www.github.com/electron/electron
github	www.github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29247

06 Oct 2026 02:41Current

CVSS 42.1

CVSS 3.12.2 - 9.8

CVSS 26.8

EPSS0.01023

SSVC