@dojo/cli-build-app (>=8.0.0-alpha.1, <=8.0.1), hey-you (3.0.10) +2 more potentially affected by CVE-2020-15215 via electron (10.1.1)

electron NPM version 10.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @dojo/cli-build-app =8.0.0-alpha.1, =2.0.1, =2.0.2 - sidewinder-viewer 0.6.1 Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ...

@dojo/cli-build-app (>=8.0.0-alpha.1, <=8.0.1), hey-you (3.0.10) +2 more potentially affected by CVE-2020-15215 via electron (10.1.1)

electron NPM version 10.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @dojo/cli-build-app =8.0.0-alpha.1, =2.0.1, =2.0.2 - sidewinder-viewer 0.6.1 Source cves: CVE-2020-15215 Source advisory: GHSA-56PC-6JQP-XQJ8...

GHSA-56PC-6JQP-XQJ8 Context isolation bypass in Electron

Impact Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nativeWindowOpen: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context an...

Context isolation bypass in Electron

Impact Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nativeWindowOpen: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context an...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15215 via electron (>=8.0.0-beta.1, <=8.5.1)

electron NPM version =8.0.0-beta.1, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ8...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.3.0) +16 more potentially affected by CVE-2020-15215 via electron (>=9.0.0-beta.1, <=9.3.0)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15215 Source advisory: GHSA-56PC-6JQP-XQJ8...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.3.0) +16 more potentially affected by CVE-2020-15215 via electron (>=9.0.0-beta.1, <=9.3.0)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ8...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15215 via electron (>=8.0.0-beta.1, <=8.5.1)

electron NPM version =8.0.0-beta.1, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15215 Source advisory: GHSA-56PC-6JQP-XQJ8...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.2.1) +16 more potentially affected by CVE-2020-15174 via electron (>=9.0.0-beta.1, <=9.2.1)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15174 Source advisory: MEND:CVE-2020-15174...

CVE-2020-15174 Unpreventable top-level navigation in Electron

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15174 via electron (>=8.0.0-beta.1, <=8.5.0)

electron NPM version =8.0.0-beta.1, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15174 Source advisory: MEND:CVE-2020-15174...

CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

CVE-2020-15174

CVE-2020-15174 affects Electron: the will-navigate event can be bypassed when a sub-frame performs a top-frame navigation across sites in several pre-11 releases (8.5.1, 9.3.0, 10.0.1, 11.0.0-beta.1). Affected versions vs patched versions are explicitly listed; remediation is to upgrade to the pa...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.2.1) +16 more potentially affected by CVE-2020-15174 via electron (>=9.0.0-beta.1, <=9.2.1)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15174 Source advisory: GHSA-2Q4G-W47C-4674...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15174 via electron (>=8.0.0-beta.1, <=8.5.0)

electron NPM version =8.0.0-beta.1, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15174 Source advisory: OSV:GHSA-2Q4G-W47C-4674...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.2.1) +16 more potentially affected by CVE-2020-15174 via electron (>=9.0.0-beta.1, <=9.2.1)

electron NPM version =9.0.0-beta.1, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =3.2.13, =3.1.0, =3.1.10 and more Source cves: CVE-2020-15174 Source advisory: OSV:GHSA-2Q4G-W47C-4674...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15174 via electron (>=8.0.0-beta.1, <=8.5.0)

electron NPM version =8.0.0-beta.1, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15174 Source advisory: GHSA-2Q4G-W47C-4674...

PT-2020-14247

Name of the Vulnerable Software and Affected Versions Electron versions prior to 11.0.0-beta.1 Electron versions prior to 10.0.1 Electron versions prior to 9.3.0 Electron versions prior to 8.5.1 Description The will-navigate event can be bypassed when a sub-frame performs a top-frame navigation...

PT-2020-14286

Name of the Vulnerable Software and Affected Versions Electron versions prior to 11.0.0-beta.6 Electron versions prior to 10.1.2 Electron versions prior to 9.3.1 Electron versions prior to 8.5.2 Description This issue is a context isolation bypass, meaning that code running in the main world...

CVE-2020-15174: Protection Mechanism Failure

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...