npm

electron

65 Total advisories

65 Vulnerabilities

0 Malware

Dependency scanning

Check whether electron is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

electron

Vulnerabilities

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron: DevTools embedder handler executes arbitrary files via shell open

Electron: Sandboxed iframes can launch external protocol handlers

Electron: contextBridge object copy honors prototype setters

Electron: window.open features string controls some window options considered privileged

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron: HTTP redirect followed into local file loader

Electron: Context isolation bypass via Function.prototype.bind hijack

Electron: shell.openPath path validation bypass via embedded null byte

Electron: Extension tab APIs operate across session boundaries

Electron: Cross-origin iframe can position native autofill popup

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Electron: Parent process code-sign check is spoofable

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Context isolation bypass via leaked cross-context objects in Electron

Context isolation bypass via contextBridge in Electron

Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Context isolation bypass via Promise in Electron

Context isolation bypass in Electron

Unpreventable top-level navigation

Arbitrary file read via window-open IPC in Electron

libwebp: OOB write in BuildHuffmanTable

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Electron: Named window.open targets not scoped to the opener's browsing context

Electron: Crash in clipboard.readImage() on malformed clipboard image data

Electron: Use-after-free in offscreen shared texture release() callback

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

Electron: Use-after-free in PowerMonitor on Windows and macOS

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Electron: Service worker can spoof executeJavaScript IPC replies

Electron: Use-after-free in offscreen child window paint callback

Electron: Use-after-free in download save dialog callback

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron: Incorrect origin passed to permission request handler for iframe requests

Electron: USB device selection not validated against filtered device list

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

IPC messages delivered to the wrong frame in Electron

Electron has ASAR Integrity Bypass via resource modification

Electron vulnerable to Heap Buffer Overflow in NativeImage

electron ASAR Integrity bypass by just modifying the content

ASAR Integrity bypass via filetype confusion in electron

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

Electron context isolation bypass via nested unserializable return value

Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled

Heap buffer overflow in GPU

Exfiltration of hashed SMB credentials on Windows via file:// redirect

AutoUpdater module fails to validate certain nested components of the bundle

Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

Renderers can obtain access to random bluetooth device without permission in Electron

Electron webPreferences vulnerability can be used to perform remote code execution

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

Electron protocol handler browser vulnerable to Command Injection

Remote Code Execution in electron

Chromium Remote Code Execution in electron

Electron vulnerable to remote command execution

Electron vulnerable to URL spoofing via PDFium

High severity vulnerability that affects electron

Browse more npm advisories

Start Securing