@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4075 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4075 Source advisory: OSV:GHSA-F9MQ-JPH6-9MHM...

GHSA-F9MQ-JPH6-9MHM Arbitrary file read via window-open IPC in Electron

Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. Workarounds Ensure you are calling event.preventDefault on all new-window events where the url or options is not something you expect. Fixed Versions 9.0.0-beta.21...

Arbitrary file read via window-open IPC in Electron

Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. Workarounds Ensure you are calling event.preventDefault on all new-window events where the url or options is not something you expect. Fixed Versions 9.0.0-beta.21...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4075 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4075 Source advisory: OSV:GHSA-F9MQ-JPH6-9MHM...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4075 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4075 Source advisory: GHSA-F9MQ-JPH6-9MHM...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4077 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4077 Source advisory: OSV:GHSA-H9JC-284H-533G...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4077 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4077 Source advisory: OSV:GHSA-H9JC-284H-533G...

GHSA-H9JC-284H-533G Context isolation bypass via contextBridge in Electron

Impact Apps using both contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workaround...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4077 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4077 Source advisory: GHSA-H9JC-284H-533G...

Context isolation bypass via contextBridge in Electron

Impact Apps using both contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workaround...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4077 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4077 Source advisory: GHSA-H9JC-284H-533G...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4076 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4076 Source advisory: GHSA-M93V-9QJC-3G79...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4076 via electron (>=7.0.0-beta.1, <=7.2.3)

electron NPM version =7.0.0-beta.1, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4076 Source advisory: OSV:GHSA-M93V-9QJC-3G79...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4076 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4076 Source advisory: OSV:GHSA-M93V-9QJC-3G79...

GHSA-M93V-9QJC-3G79 Context isolation bypass via leaked cross-context objects in Electron

Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4076 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4076 Source advisory: GHSA-M93V-9QJC-3G79...

Context isolation bypass via leaked cross-context objects in Electron

Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your...

@donmahallem/trapeze-client-electron (>=1.5.3, <=1.6.0), @evgenious/electron-prebuilt-compile (6.0.3) +13 more potentially affected by CVE-2020-15096 via electron (>=6.0.0-beta.1, <=6.1.10)

electron NPM version =6.0.0-beta.1, =1.5.3, =6.0.0-beta.1, =6.0.0-beta.1, =0.1.0, =0.5.17, =1.0.2, =3.0.2, =1.1.6, =3.0.3, =0.0.1, =0.0.38 Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-15096 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-15096 Source advisory: GHSA-6VRV-94JV-CRRG...

@donmahallem/trapeze-client-electron (>=1.5.3, <=1.6.0), @evgenious/electron-prebuilt-compile (6.0.3) +13 more potentially affected by CVE-2020-15096 via electron (>=6.0.0-beta.1, <=6.1.10)

electron NPM version =6.0.0-beta.1, =1.5.3, =6.0.0-beta.1, =6.0.0-beta.1, =0.1.0, =0.5.17, =1.0.2, =3.0.2, =1.1.6, =3.0.3, =0.0.1, =0.0.38 Source cves: CVE-2020-15096 Source advisory: GHSA-6VRV-94JV-CRRG...