electron
Build cross platform desktop apps with JavaScript, HTML, and CSS
Security Advisories for electron in npm
Moderate
7 days ago
Electron: SameSite cookie restrictions are not applied to windows opened from links
npm
electron
Moderate
7 days ago
Electron: Pointer lock permission requests can be attributed to the wrong frame
npm
electron
Low
7 days ago
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
npm
electron
Low
7 days ago
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
npm
electron
Moderate
7 days ago
Electron: openExternal permission requests can be attributed to the wrong origin
npm
electron
Moderate
8 days ago
Electron: HID and USB permission checks can be attributed to the wrong origin
npm
electron
Moderate
30 days ago
Electron: Local race condition in Squirrel.Mac update installation on macOS
npm
electron
High
30 days ago
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
npm
electron
High
30 days ago
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
npm
electron
High
30 days ago
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
npm
electron
High
30 days ago
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
npm
electron
High
30 days ago
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
npm
electron
Moderate
3 months ago
Electron: Sandboxed iframes can launch external protocol handlers
npm
electron
Moderate
3 months ago
Electron: DevTools embedder handler executes arbitrary files via shell open
npm
electron
Moderate
3 months ago
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
npm
electron
High
3 months ago
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
npm
electron
Moderate
3 months ago
Electron: window.open features string controls some window options considered privileged
npm
electron
Moderate
3 months ago
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
npm
electron
High
3 months ago
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
npm
electron
Moderate
3 months ago
Electron: shell.openPath path validation bypass via embedded null byte
npm
electron
High
3 months ago
Electron: Context isolation bypass via Function.prototype.bind hijack
npm
electron
Moderate
3 months ago
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
npm
electron
Low
3 months ago
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
npm
electron
Critical
5 months ago
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
npm
electron
Low
7 months ago
Electron: Crash in clipboard.readImage() on malformed clipboard image data
npm
electron
Moderate
7 months ago
Electron: Named window.open targets not scoped to the opener's browsing context
npm
electron
Low
7 months ago
Electron: Use-after-free in offscreen shared texture release() callback
npm
electron
High
7 months ago
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
npm
electron
Moderate
7 months ago
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
npm
electron
Moderate
7 months ago
Electron: Incorrect origin passed to permission request handler for iframe requests
npm
electron
Moderate
7 months ago
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
npm
electron
Moderate
7 months ago
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
npm
electron
Moderate
7 months ago
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
npm
electron
High
7 months ago
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks
npm
electron
High
7 months ago
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
npm
electron
Low
7 months ago
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
npm
electron
Moderate
7 months ago
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest
npm
electron
Low
7 months ago
Electron: USB device selection not validated against filtered device list
npm
electron
High
about 3 years ago
Electron affected by libvpx's heap buffer overflow in vp8 encoding
npm
electron
High
about 3 years ago
libwebp: OOB write in BuildHuffmanTable
go, nuget, cargo, pypi, npm
github.com/chai2010/webp, magick.net-q8-x64, magick.net-q8-openmp-x64, magick.net-q8-anycpu, magick.net-q16-x64, magick.net-q16-hdri-anycpu, magick.net-q16-anycpu, webp, Pillow, SkiaSharp, electron, libwebp-sys, libwebp-sys2
Moderate
about 3 years ago
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
npm
electron
Moderate
about 3 years ago
Electron context isolation bypass via nested unserializable return value
npm
electron
High
about 3 years ago
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
npm
electron
Moderate
almost 4 years ago
Exfiltration of hashed SMB credentials on Windows via file:// redirect
npm
electron
Moderate
over 4 years ago
AutoUpdater module fails to validate certain nested components of the bundle
npm
electron
Low
over 4 years ago
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
npm
electron
Low
over 4 years ago
Renderers can obtain access to random bluetooth device without permission in Electron
npm
electron
Moderate
about 5 years ago
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
npm
electron
High
over 6 years ago
Context isolation bypass via leaked cross-context objects in Electron
npm
electron
High
about 8 years ago
Electron webPreferences vulnerability can be used to perform remote code execution
npm
electron
High
over 8 years ago
Electron protocol handler browser vulnerable to Command Injection
npm
electron
High
over 8 years ago
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
npm
electron