CVE-2024-27303

The CVE-2024-27303 vulnerability affects electron-builder’s NSIS installer prior to 24.13.2 on Windows. The NSIS installer runs NSExec, which by default searches the install folder before PATH. If an attacker places a malicious cmd.exe in the same folder as the installer, that executable can be e...

CVE-2024-39698

The CVE-2024-39698 entry concerns a Windows code-signing bypass in electron-updater. A flaw in the verification routine in packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts arises because the surrounding shell (cmd.exe) expands environment variables in the command line, enab...