CVE-2024-39698

electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...

CVE-2024-39698

electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...

CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...

@ascua/app (>=0.1.0, <=0.4.6), @itsfe/electron-bootstrap (>=1.0.0, <=1.0.1) +7 more potentially affected by CVE-2024-39698 via electron-updater (>=6.0.2, <=6.2.1)

electron-updater NPM version =6.0.2, =0.1.0, =1.0.0, =0.11.11-dev.1, =0.0.0-snapshot-20240316121210, =2024.4.146, =2024.10.110 Source cves: CVE-2024-39698 Source advisory: OSV:GHSA-9JXC-QJR9-VJXQ...