@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-15096 via electron (>=7.0.0, <=7.2.3)

electron NPM version =7.0.0, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-15096 Source advisory: MEND:CVE-2020-15096...

CVE-2020-15096

CVE-2020-15096 affects Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21. A context isolation bypass allows code running in the renderer’s main world context to reach into the isolated Electron context and perform privileged actions. The issue impacts apps that enable contextIsolatio...

CVE-2020-15096

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. Ther...

CVE-2020-15096 Context isolation bypass via Promise in Electron

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. Ther...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4075 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4075 Source advisory: MEND:CVE-2020-4075...

4cdl (>=1.0.1, <=1.0.7), 77cli (>=0.0.10, <=0.0.12) +1512 more potentially affected by CVE-2020-4075 via electron (>=0.1.2, <=7.2.3)

electron NPM version =0.1.2, =1.0.1, =0.0.10, =0.1.0, =3.0.5, =0.1.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.10, =0.3.0, =0.3.1, =0.3.4 and more Source cves: CVE-2020-4075 Source advisory: MEND:CVE-2020-4075...

CVE-2020-4075

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling "event.preventDefault" on all new-window events where the "url" or "options" is not...

CVE-2020-4075 Arbitrary file read via window-open IPC in Electron

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault on all new-window events where the url or options is not...

CVE-2020-4075

Summary: CVE-2020-4075 affects Electron before 7.2.4, 8.2.4, and 9.0.0-beta21, allowing arbitrary local file read by defining unsafe window options on a child window opened with window.open. Root cause: unsafe window options on child windows. Impact: local file read via manipulated window options...

CVE-2020-4076

CVE-2020-4076 in Electron: context isolation bypass allows code in the main world of the renderer to reach into the isolated Electron context and perform privileged actions when contextIsolation is enabled. Affected versions are Electron before 7.2.4, 8.2.4, and 9.0.0-beta21. The vulnerability is...

4cdl (>=1.0.1, <=1.0.7), 77cli (>=0.0.10, <=0.0.12) +1512 more potentially affected by CVE-2020-4076 via electron (>=0.1.2, <=7.2.3)

electron NPM version =0.1.2, =1.0.1, =0.0.10, =0.1.0, =3.0.5, =0.1.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.10, =0.3.0, =0.3.1, =0.3.4 and more Source cves: CVE-2020-4076 Source advisory: MEND:CVE-2020-4076...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4076 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4076 Source advisory: MEND:CVE-2020-4076...

CVE-2020-4076

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions...

CVE-2020-4076 Context isolation bypass via leaked cross-context objects in Electron

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4077 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4077 Source advisory: MEND:CVE-2020-4077...

CVE-2020-4077 Context isolation bypass via contextBridge in Electron

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. Thi...

CVE-2020-4077

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both "contextIsolation" and "contextBridge" are affected...

4cdl (>=1.0.1, <=1.0.7), 77cli (>=0.0.10, <=0.0.12) +1512 more potentially affected by CVE-2020-4077 via electron (>=0.1.2, <=7.2.3)

electron NPM version =0.1.2, =1.0.1, =0.0.10, =0.1.0, =3.0.5, =0.1.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.10, =0.3.0, =0.3.1, =0.3.4 and more Source cves: CVE-2020-4077 Source advisory: MEND:CVE-2020-4077...

CVE-2020-4077

In Electron, a context isolation bypass affects versions prior to 7.2.4, 8.2.4, and 9.0.0-beta21 where code in the main world of a renderer can access the isolated Electron context when both contextIsolation and contextBridge are used. The issue is fixed in 7.2.4, 8.2.4, and 9.0.0-beta.21. Mitiga...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4075 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4075 Source advisory: GHSA-F9MQ-JPH6-9MHM...