electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in v8, when processing a very large number of parameters.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in components/octoprint, which uses custom Octoprint HTTP sessions. The default ssl parameter configuration uses the value False or None, which causes the SSL verification functionality to run and prevents information exposure. But in the Octoprint integration these default SSLContext settings can be bypassed by passing in use-ssl=true, which results in malicious connections appearing trusted and allowing MitM attacks.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the Resource and Permissions module of the admin console. A privileged user can inject scripts during the creation of a permission.