electron
Build cross platform desktop apps with JavaScript, HTML, and CSS
Security Advisories for electron in npm
Low
2 months ago
Electron: Crash in clipboard.readImage() on malformed clipboard image data
npm
electron
Moderate
2 months ago
Electron: Named window.open targets not scoped to the opener's browsing context
npm
electron
Low
2 months ago
Electron: Use-after-free in offscreen shared texture release() callback
npm
electron
High
2 months ago
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
npm
electron
Moderate
2 months ago
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
npm
electron
Moderate
2 months ago
Electron: Incorrect origin passed to permission request handler for iframe requests
npm
electron
Moderate
2 months ago
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
npm
electron
Moderate
2 months ago
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
npm
electron
Moderate
2 months ago
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
npm
electron
High
2 months ago
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
npm
electron
High
2 months ago
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
npm
electron
Low
2 months ago
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
npm
electron
Moderate
2 months ago
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
npm
electron
Low
2 months ago
Electron: USB device selection not validated against filtered device list
npm
electron
High
over 2 years ago
Electron affected by libvpx's heap buffer overflow in vp8 encoding
npm
electron
High
over 2 years ago
libwebp: OOB write in BuildHuffmanTable
npm, cargo
electron, libwebp-sys, libwebp-sys2
Moderate
almost 3 years ago
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
npm
electron
Moderate
almost 3 years ago
Electron context isolation bypass via nested unserializable return value
npm
electron
High
almost 3 years ago
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
npm
electron
Moderate
over 3 years ago
Exfiltration of hashed SMB credentials on Windows via file:// redirect
npm
electron
Moderate
almost 4 years ago
AutoUpdater module fails to validate certain nested components of the bundle
npm
electron
Low
almost 4 years ago
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
npm
electron
Low
about 4 years ago
Renderers can obtain access to random bluetooth device without permission in Electron
npm
electron
Moderate
over 4 years ago
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
npm
electron
High
almost 6 years ago
Context isolation bypass via leaked cross-context objects in Electron
npm
electron
High
almost 8 years ago
Electron webPreferences vulnerability can be used to perform remote code execution
npm
electron
High
about 8 years ago
Electron protocol handler browser vulnerable to Command Injection
npm
electron
High
about 8 years ago
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
npm
electron