| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 42.0.0≥ 40.0.0, < 40.9.0≥ 41.0.0, < 41.2.1< 39.8.8 | 40.9.041.2.139.8.8 |
| electron | ≥ 40.0.0-alpha.1, < 40.9.1≥ 41.0.0-alpha.1, < 41.2.1≥ 42.0.0-alpha.1, < 42.0.0-beta.3< 39.8.8 | 40.9.141.2.142.0.0-beta.339.8.8 |
When following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.
Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.
Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.
42.0.0-beta.341.2.140.9.039.8.8If you have any questions or comments about this advisory, email Electron at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free