GHSA-7X97-J373-85X5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

🗓️ 06 Sep 2023 19:51:33Reported by GoogleType

osv

osv🔗 osv.dev👁 15 Views

Electron code execution vulnerability when launched with arbitrary cw

Reporter	Title	Published	Views	Family All 24
BDU FSTEC	The vulnerability of the Electron application development framework is related to inadequate control over code generation, allowing attackers to execute arbitrary code.	22 Nov 202300:00	–	bdu_fstec
CNNVD	Electron Code Injection Vulnerability	6 Sep 202300:00	–	cnnvd
CVE	CVE-2023-39956	6 Sep 202320:09	–	cve
Cvelist	CVE-2023-39956 Electron: Out-of-package code execution when launched with arbitrary cwd	6 Sep 202320:09	–	cvelist
EUVD	EUVD-2023-2462	3 Oct 202520:07	–	euvd
Github Security Blog	Electron vulnerable to out-of-package code execution when launched with arbitrary cwd	6 Sep 202319:51	–	github
Kaspersky	KLA60561 Multiple vulnerabilities in Microsoft Developer Tools	12 Sep 202300:00	–	kaspersky
Tenable Nessus	Security Update for Microsoft Visual Studio Code (September 2023)	13 Sep 202300:00	–	nessus
Microsoft CVE	Electron: CVE-2023-39956 -Visual Studio Code Remote Code Execution Vulnerability	12 Sep 202307:00	–	mscve
NCSC	Vulnerabilities fixed in Microsoft Developer Tools	12 Sep 202300:00	–	ncsc

Source	Link
github	www.github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-39956
github	www.github.com/electron/electron

08 Nov 2023 04:13Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.1

EPSS0.00563

electron vulnerability code execution arbitrary path command line exploit working directory write files threat model local attacks asar integrity patch update security advisory