Inappropriate Implementation Affecting electron package, versions <13.6.6>=14.0.0 <14.2.2>=15.0.0 <15.3.3


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.45% (76th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JS-ELECTRON-1924895
  • published9 Jan 2022
  • disclosed23 Nov 2021
  • creditLuan Herrera

Introduced: 23 Nov 2021

CVE-2021-38009  (opens in a new tab)
CWE-668  (opens in a new tab)

How to fix?

Upgrade electron to version 13.6.6, 14.2.2, 15.3.3 or higher.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate Implementation via cache in Google Chrome. This allows a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS Scores

version 3.1