| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 41.0.0≥ 39.0.0, < 39.8.0≥ 40.0.0, < 40.7.0< 38.8.6 | 39.8.040.7.038.8.6 |
| electron | ≥ 39.0.0-alpha.1, < 39.8.0≥ 40.0.0-alpha.1, < 40.7.0≥ 41.0.0-alpha.1, < 41.0.0-beta.8< 38.8.6 | 39.8.040.7.041.0.0-beta.838.8.6 |
An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.
Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected.
Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.
41.0.0-beta.840.7.039.8.038.8.6If there are any questions or comments about this advisory, send an email to [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free