Electron vulnerable to URL spoofing via PDFium

GHSA-6h98-cf9g-vmg2 · CVE-2017-1000424

Published May 13, 2022 · Modified Nov 8, 2023

Description

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2017-1000424
WEB https://github.com/electron/electron/pull/10008
WEB https://github.com/electron/electron/pull/10008/files
PACKAGE https://github.com/electron/electron
WEB https://github.com/electron/electron/releases/tag/v1.7.6

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes