carbon (>=0.3.0 <=0.4.0), carbon-logger (=0.1.0) +3 more potentially affected by CVE-2016-1202 via electron (>=0.1.2 <=0.2.1)

electron NPM version =0.1.2, =0.3.0, =0.1.0, =0.2.0, =0.2.2 Source cves: CVE-2016-1202 Source advisory: OSV:GHSA-GVCJ-PFQ2-WXJ7...

CVE-2016-1202

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line...

CVE-2016-1202

CVE-2016-1202 affects Electron up to version before 0.33.5, where untrusted search path logic allows local attackers to escalate privileges by placing a malicious Node.js module in a parent directory of a require path. Core issue: Electron does not restrict the search path for loading Node module...