| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 9.0.0≥ 7.0.0, < 7.2.4≥ 8.0.0, < 8.2.4 | 7.2.48.2.4 |
| electron | ≥ 8.0.0, < 8.2.4< 7.2.4 | 8.2.47.2.4 |
The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.
Ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect.
9.0.0-beta.218.2.47.2.4If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free