deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-532v-xpq5-8h95
Package: electron (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-416: Use After Free
Vulnerable versions: < 39.8.1
Patched in: 39.8.1

Summary: Electron: Use-after-free in offscreen child window paint callback

Details:
### Impact
Apps that use offscreen rendering and allow child windows via `window.open()` may be vulnerable to a use-after-free. If the parent offscreen `WebContents` is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (`webPreferences.offscreen: true`) and their `setWindowOpenHandler` permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

### Workarounds
Deny child window creation from offscreen renderers in your `setWindowOpenHandler`, or ensure child windows are closed before the parent is destroyed.

### Fixed Versions
* `41.0.0`
* `40.7.0`
* `39.8.1`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-mwmh-mq4g-g6gr
Package: electron (NPM)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-20: Improper Input Validation, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Details:
### Impact
On Windows, `app.setAsDefaultProtocolClient(protocol)` did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under `HKCU\Software\Classes\`, potentially hijacking existing protocol handlers.

Apps are only affected if they call `app.setAsDefaultProtocolClient()` with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

### Workarounds
Validate the protocol name matches `/^[a-zA-Z][a-zA-Z0-9+.-]*$/` before passing it to `app.setAsDefaultProtocolClient()`.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-mwmh-mq4g-g6gr
Package: electron (NPM)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-20: Improper Input Validation, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.1
Patched in: 40.8.1

Summary: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Details:
### Impact
On Windows, `app.setAsDefaultProtocolClient(protocol)` did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under `HKCU\Software\Classes\`, potentially hijacking existing protocol handlers.

Apps are only affected if they call `app.setAsDefaultProtocolClient()` with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

### Workarounds
Validate the protocol name matches `/^[a-zA-Z][a-zA-Z0-9+.-]*$/` before passing it to `app.setAsDefaultProtocolClient()`.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-mwmh-mq4g-g6gr
Package: electron (NPM)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-20: Improper Input Validation, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Details:
### Impact
On Windows, `app.setAsDefaultProtocolClient(protocol)` did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under `HKCU\Software\Classes\`, potentially hijacking existing protocol handlers.

Apps are only affected if they call `app.setAsDefaultProtocolClient()` with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

### Workarounds
Validate the protocol name matches `/^[a-zA-Z][a-zA-Z0-9+.-]*$/` before passing it to `app.setAsDefaultProtocolClient()`.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-mwmh-mq4g-g6gr
Package: electron (NPM)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-20: Improper Input Validation, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Details:
### Impact
On Windows, `app.setAsDefaultProtocolClient(protocol)` did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under `HKCU\Software\Classes\`, potentially hijacking existing protocol handlers.

Apps are only affected if they call `app.setAsDefaultProtocolClient()` with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected.

### Workarounds
Validate the protocol name matches `/^[a-zA-Z][a-zA-Z0-9+.-]*$/` before passing it to `app.setAsDefaultProtocolClient()`.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9w97-2464-8783
Package: electron (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0-beta.7
Patched in: 41.0.0-beta.7

Summary: Electron: Use-after-free in download save dialog callback

Details:
### Impact
Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

### Workarounds
Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

### Fixed Versions
* `41.0.0-beta.7`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9w97-2464-8783
Package: electron (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 40.0.0-alpha.1, < 40.7.0
Patched in: 40.7.0

Summary: Electron: Use-after-free in download save dialog callback

Details:
### Impact
Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

### Workarounds
Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

### Fixed Versions
* `41.0.0-beta.7`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9w97-2464-8783
Package: electron (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.0
Patched in: 39.8.0

Summary: Electron: Use-after-free in download save dialog callback

Details:
### Impact
Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

### Workarounds
Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

### Fixed Versions
* `41.0.0-beta.7`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9w97-2464-8783
Package: electron (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-416: Use After Free
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Use-after-free in download save dialog callback

Details:
### Impact
Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

### Workarounds
Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

### Fixed Versions
* `41.0.0-beta.7`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-8337-3p73-46f4
Package: electron (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0-beta.8
Patched in: 41.0.0-beta.8

Summary: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Details:
### Impact
Apps that register an asynchronous `session.setPermissionRequestHandler()` may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

### Workarounds
Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-8337-3p73-46f4
Package: electron (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 40.0.0-alpha.1, < 40.7.0
Patched in: 40.7.0

Summary: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Details:
### Impact
Apps that register an asynchronous `session.setPermissionRequestHandler()` may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

### Workarounds
Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-8337-3p73-46f4
Package: electron (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.0
Patched in: 39.8.0

Summary: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Details:
### Impact
Apps that register an asynchronous `session.setPermissionRequestHandler()` may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

### Workarounds
Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-8337-3p73-46f4
Package: electron (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-416: Use After Free
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Details:
### Impact
Apps that register an asynchronous `session.setPermissionRequestHandler()` may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

### Workarounds
Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-jjp3-mq3x-295m
Package: electron (NPM)
Severity: HIGH (CVSS 7.0)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0-beta.8
Patched in: 41.0.0-beta.8

Summary: Electron: Use-after-free in PowerMonitor on Windows and macOS

Details:
### Impact
Apps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-jjp3-mq3x-295m
Package: electron (NPM)
Severity: HIGH (CVSS 7.0)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.0
Patched in: 40.8.0

Summary: Electron: Use-after-free in PowerMonitor on Windows and macOS

Details:
### Impact
Apps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-jjp3-mq3x-295m
Package: electron (NPM)
Severity: HIGH (CVSS 7.0)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: Use-after-free in PowerMonitor on Windows and macOS

Details:
### Impact
Apps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-jjp3-mq3x-295m
Package: electron (NPM)
Severity: HIGH (CVSS 7.0)
CWE: CWE-416: Use After Free
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Use-after-free in PowerMonitor on Windows and macOS

Details:
### Impact
Apps that use the `powerMonitor` module may be vulnerable to a use-after-free. After the native `PowerMonitor` object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption.

All apps that access `powerMonitor` events (`suspend`, `resume`, `lock-screen`, etc.) are potentially affected. The issue is not directly renderer-controllable.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9wfr-w7mm-pc7f
Package: electron (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-912: Hidden Functionality
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0-beta.8
Patched in: 41.0.0-beta.8

Summary: Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Details:
### Impact
An undocumented `commandLineSwitches` webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct `webPreferences` by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct `webPreferences` from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded `webPreferences` object are not affected.

### Workarounds
Do not spread untrusted input into `webPreferences`. Use an explicit allowlist of permitted preference keys when constructing `BrowserWindow` or `webContents` options from external configuration.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9wfr-w7mm-pc7f
Package: electron (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-912: Hidden Functionality
Vulnerable versions: >= 40.0.0-alpha.1, < 40.7.0
Patched in: 40.7.0

Summary: Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Details:
### Impact
An undocumented `commandLineSwitches` webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct `webPreferences` by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct `webPreferences` from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded `webPreferences` object are not affected.

### Workarounds
Do not spread untrusted input into `webPreferences`. Use an explicit allowlist of permitted preference keys when constructing `BrowserWindow` or `webContents` options from external configuration.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-9wfr-w7mm-pc7f
Package: electron (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-912: Hidden Functionality
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.0
Patched in: 39.8.0

Summary: Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Details:
### Impact
An undocumented `commandLineSwitches` webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct `webPreferences` by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct `webPreferences` from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded `webPreferences` object are not affected.

### Workarounds
Do not spread untrusted input into `webPreferences`. Use an explicit allowlist of permitted preference keys when constructing `BrowserWindow` or `webContents` options from external configuration.

### Fixed Versions
* `41.0.0-beta.8`
* `40.7.0`
* `39.8.0`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)