GHSA-37J4-88RP-2F6H Electerm's full process.env exposed to renderer via window.pre.env

Impact The getConstants IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer e.g., via the DevTools console or a compromised webview context...

The vulnerability of the MinIO object storage server arises from the exposure of all environment variables, including “MINIO_SECRET_KEY” and “MINIO_ROOT_PASSWORD”, which allow attackers to expose the protected information.

The vulnerability of the MinIO object storage server lies in the fact that all environment variables, including “MINIOSECRETKEY” and “MINIOROOTPASSWORD”, are returned. Exploiting this vulnerability allows a malicious actor to expose the protected information...