CVE-2020-15215

2020-10-0618:15:14

Google

osv.dev

electron

vulnerability

context isolation bypass

nodeintegrationinsubframes

privileged actions

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.