CVE-2023-23623

The CVE-2023-23623 issue is in Electron where a Content-Security-Policy that disables eval (script-src without unsafe-eval) is not respected in renderers with sandbox: false. Affected are Electron 22 and 23 series; the vulnerability can allow unintended use of eval() or new Function, expanding th...

CVE-2023-23623 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderers that have sandb...

@finsemble/finsemble-core (>=1.0.0-beta-9, <=8.4.3), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-9, <=8.4.3) +5 more potentially affected by CVE-2023-23623 via electron (22.0.0)

electron NPM version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @finsemble/finsemble-core =1.0.0-beta-9, =1.0.0-beta-9, =0.0.1-alpha.2022-12-11.1670718306317, =1.3.0, =2.0.92, =2.0.94 Source cves:...