| Package | Affected versions | Patched versions |
|---|---|---|
| electron | ≥ 39.0.0, < 39.8.3≥ 40.0.0, < 40.8.3≥ 41.0.0, < 41.0.3< 38.8.6 | 39.8.340.8.341.0.338.8.6 |
| electron | ≥ 39.0.0-alpha.1, < 39.8.3≥ 40.0.0-alpha.1, < 40.8.3≥ 41.0.0-alpha.1, < 41.0.3< 38.8.6 | 39.8.340.8.341.0.338.8.6 |
Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.
An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.
Apps that do not reflect external input into response headers are not affected.
Validate or sanitize any untrusted input before including it in a response header name or value.
41.0.340.8.339.8.338.8.6If there are any questions or comments about this advisory, send an email to [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free