@manniwatch/client-desktop (>=0.28.0, <=0.28.2), @yeti-dev/electroshot (>=1.4.3, <=1.4.6) +5 more potentially affected by CVE-2022-29257 via electron (>=15.0.0, <=15.3.7)

electron NPM version =15.0.0, =0.28.0, =1.4.3, =1.0.0, =2.0.53, =6.0.15, =6.1.2 - simple-git-gui 3.8.2 - xyz-ttooc-log-electron-windows 0.1.5 Source cves: CVE-2022-29257 Source advisory: OSV:GHSA-77XC-HJV8-WW97...

@finsemble/finsemble-electron-adapter (>=7.0.0, <=7.0.1), @manniwatch/client-desktop (>=0.28.3, <=0.29.1) +9 more potentially affected by CVE-2022-29257 via electron (>=16.0.2, <=16.0.10)

electron NPM version =16.0.2, =7.0.0, =0.28.3, =0.0.1, =0.0.14, =0.0.15, =2.0.56, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2022-29257 Source advisory: OSV:GHSA-77XC-HJV8-WW97...

@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29257 via electron (>=17.0.0, <=17.1.2)

electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29257 Source advisory: OSV:GHSA-77XC-HJV8-WW97...

GHSA-77XC-HJV8-WW97 AutoUpdater module fails to validate certain nested components of the bundle

Impact This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. Please note that this kind of attack would require...

AutoUpdater module fails to validate certain nested components of the bundle

Impact This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. Please note that this kind of attack would require...

GHSA-MQ8J-3H7H-P8G7 Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

Impact This vulnerability allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames enabled which in turn allows effective access to ipcRenderer. Please note the misleadingly named nodeIntegrationInSubFrames option does not implicitly grant...

@finsemble/finsemble-electron-adapter (>=7.0.0-beta.2, <=7.0.1), @manniwatch/client-desktop (>=0.28.3, <=0.29.1) +9 more potentially affected by CVE-2022-29247 via electron (>=16.0.2, <=16.2.3)

electron NPM version =16.0.2, =7.0.0-beta.2, =0.28.3, =0.0.1, =0.0.14, =0.0.15, =2.0.56, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

Impact This vulnerability allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames enabled which in turn allows effective access to ipcRenderer. Please note the misleadingly named nodeIntegrationInSubFrames option does not implicitly grant...

@manniwatch/client-desktop (>=0.28.0, <=0.28.2), @yeti-dev/electroshot (>=1.4.3, <=1.4.6) +5 more potentially affected by CVE-2022-29247 via electron (>=15.0.0, <=15.3.7)

electron NPM version =15.0.0, =0.28.0, =1.4.3, =1.0.0, =2.0.53, =6.0.15, =6.1.2 - simple-git-gui 3.8.2 - xyz-ttooc-log-electron-windows 0.1.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29247 via electron (>=17.0.0, <=17.1.2)

electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

Privilege Escalation

electron is vulnerable to privilege escalation. When the nodeIntegrationInSubFrames enable, An attacker can get access to a new renderer process within JS execution, and if the application exposes IPC messages without IPC senderFrame validation, leading to gaining access to confidential data in...

CVE-2022-29257

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

Design/Logic Flaw

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29257 Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29257

Summary: CVE-2022-29257 affects Electron up to version 18.0.0-beta.6 (and older 17.2.0, 16.2.6, 15.5.5). If an attacker controls a victim app’s update server/storage, they can serve update packages that pass code signing validation but run malicious code in some components. The vulnerability aris...

CVE-2022-29257 Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29257 Electron's AutoUpdater module fails to validate certain nested components of the bundle

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29257

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafte...

CVE-2022-29247

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...

Design/Logic Flaw

Electron is a framework for writing cross-platform desktop applications using JavaScript JS, HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with nodeIntegrationInSubFrames...