Information Exposure Affecting electron package, versions <8.5.2>=9.0.0 <9.3.1>=10.0.0-beta.1 <10.1.2>=11.0.0-beta.1 <11.0.0-beta.6


Severity

Recommended
0.0
medium
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.28% (52nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JS-ELECTRON-10587791
  • published3 Jul 2025
  • disclosed6 Oct 2020
  • creditUnknown

Introduced: 6 Oct 2020

CVE-2020-15215  (opens in a new tab)
CWE-668  (opens in a new tab)
CWE-693  (opens in a new tab)

How to fix?

Upgrade electron to version 8.5.2, 9.3.1, 10.1.2, 11.0.0-beta.6 or higher.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure. Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both contextIsolation and sandbox: true are affected. Apps using both contextIsolation and nodeIntegrationInSubFrames: true are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

References

CVSS Base Scores

version 3.1