| Package | Affected versions | Patched versions |
|---|---|---|
| electron | ≥ 40.0.0-alpha.1, < 41.10.5≥ 42.0.0-alpha.1, < 42.0.0-beta.2< 39.8.10 | 41.10.542.0.0-beta.239.8.10 |
On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.
Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.
There are no app side workarounds, you must update to a patched version of Electron.
42.0.0-beta.241.10.539.8.10If you have any questions or comments about this advisory, email us at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free