In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsUpgrade electron
to version 2.0.17, 3.0.15, 3.1.3, 4.0.4, 5.0.0-beta.2 or higher.
If for some reason you are unable to upgrade your Electron version, you can mitigate this issue by disabling all child web contents: view.webContents.on('-add-new-contents', e => e.preventDefault());
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Arbitrary Code Execution.
Opening a BrowserView
with sandbox: true
or nativeWindowOpen: true
and nodeIntegration: false
results in a webContents
where window.open()
can be called and the newly opened child will have nodeIntegration enabled.