| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 10.0.0= 10.0.1= 10.1.0= 10.1.1= 11.0.0= 8.0.0= 8.0.1= 8.0.2= 8.0.3= 8.1.0= 8.1.1= 8.2.0= 8.2.1= 8.2.2= 8.2.3= 8.2.4= 8.2.5= 8.3.0= 8.3.1= 8.3.2= 8.3.3= 8.3.4= 8.4.0= 8.4.1= 8.5.0= 8.5.1= 9.0.0= 9.0.1= 9.0.2= 9.0.3= 9.0.4= 9.0.5= 9.0.6= 9.1.0= 9.1.1= 9.1.2= 9.2.0= 9.2.1= 9.3.0 | |
| electron | ≥ 10.0.0-beta.0, < 10.1.2≥ 11.0.0-beta.0, < 11.0.0-beta.6≥ 8.0.0-beta.0, < 8.5.2≥ 9.0.0-beta.0, < 9.3.1 | 10.1.211.0.0-beta.68.5.29.3.1 |
Apps using both contextIsolation and sandbox: true are affected.
Apps using both contextIsolation and nativeWindowOpen: true are affected.
This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
There are no app-side workarounds, you must update your Electron version to be protected.
11.0.0-beta.610.1.29.3.18.5.2If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free