| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 9.0.0≥ 7.0.0, < 7.2.4≥ 8.0.0, < 8.2.4 | 7.2.48.2.4 |
| electron | ≥ 8.0.0, < 8.2.4< 7.2.4 | 8.2.47.2.4 |
Apps using both contextIsolation and contextBridge are affected.
This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
There are no app-side workarounds, you must update your Electron version to be protected.
9.0.0-beta.218.2.47.2.4If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free