Tóm tắt nhanh
- CVE-2026-102677 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng electron (electronjs), electron.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.10%, cao hơn 0.80% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 43.4.2, 42.10.0, 43.5.0, 44.0.0-beta.6 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| electron | = 44.0.0≥ 42.3.3, ≤ 42.10.0≥ 43.0.0, < 43.4.2
| 43.4.2
|
| electron npm | ≥ 42.3.3, < 42.10.0≥ 43.0.0-beta.1, < 43.5.0≥ 44.0.0-alpha.1, < 44.0.0-beta.6
| 42.10.043.5.044.0.0-beta.6
|
Mô tả
Impact
The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.
Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
44.0.0-beta.643.5.0 42.10.0
For more information
If you have any questions or comments about this advisory, email us at [email protected]
Mô tả của NVD
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí