992145 matches found
Electron: Sandboxed iframes can launch external protocol handlers
Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...
GHSA-P2RR-RVMM-C5FP Electron: Sandboxed iframes can launch external protocol handlers
Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...
CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...
CVE-2026-70612
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...
CVE-2026-70612
The vulnerability CVE-2026-70612 affects Electron. It occurs when web content in sandboxed iframes can trigger external protocol handlers, because iframe sandbox restrictions were not applied to openExternal requests and the frame state wasn’t exposed to permission handlers. This could allow an O...
Electron: DevTools embedder handler executes arbitrary files via shell open
Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...
GHSA-F2R8-JV7C-XQMP Electron: DevTools embedder handler executes arbitrary files via shell open
Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...
NPM: Electron: DevTools embedder handler executes arbitrary files via shell open
NPM: Electron: DevTools embedder handler executes arbitrary files via shell open vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...
CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...
opentaint analyzer/latest
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...
CVE-2026-7657 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...
CVE-2026-7657
IBM Langflow OSS versions 1.0.0–1.10.3 are affected by server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement. The CVSS vector indicates network access with low attack complexity, requiring low privileges and no user interaction, with a high confidentiali...
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Impact The mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if...
GHSA-4F78-QHMW-8J8M Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Impact The mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if...
CVE-2026-70609 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...
CVE-2026-70609
Electron contains a vulnerability where the mode option for webContents.openDevTools() was not sanitized by the DevTools frontend prior to versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1. If an attacker can influence this value, script execution could occur within the DevTools context, which i...
CVE-2026-70609 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...
CVE-2026-70608
Summary: Electron before versions 39.8.10, 41.10.3, and 42.0.1 allowed a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler with no user interaction via OpenURL navigation, bypassing the iframe popup restriction. What’s affected: Electron apps e...
CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...
EUVD-2026-53564
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...