deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5rqw-r77c-jp79
Package: electron (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Details:
### Impact
On macOS, `app.moveToApplicationsFolder()` used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call `app.moveToApplicationsFolder()`. Apps that do not use this API are not affected.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-5rqw-r77c-jp79
Package: electron (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Details:
### Impact
On macOS, `app.moveToApplicationsFolder()` used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call `app.moveToApplicationsFolder()`. Apps that do not use this API are not affected.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0-beta.8`
* `40.8.0`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xj5x-m3f3-5x3h
Package: electron (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: Service worker can spoof executeJavaScript IPC replies

Details:
### Impact
A service worker running in a session could spoof reply messages on the internal IPC channel used by `webContents.executeJavaScript()` and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of `webContents.executeJavaScript()` (or `webFrameMain.executeJavaScript()`) in security-sensitive decisions.

### Workarounds
Do not trust the return value of `webContents.executeJavaScript()` for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xj5x-m3f3-5x3h
Package: electron (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.1
Patched in: 40.8.1

Summary: Electron: Service worker can spoof executeJavaScript IPC replies

Details:
### Impact
A service worker running in a session could spoof reply messages on the internal IPC channel used by `webContents.executeJavaScript()` and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of `webContents.executeJavaScript()` (or `webFrameMain.executeJavaScript()`) in security-sensitive decisions.

### Workarounds
Do not trust the return value of `webContents.executeJavaScript()` for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xj5x-m3f3-5x3h
Package: electron (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: Service worker can spoof executeJavaScript IPC replies

Details:
### Impact
A service worker running in a session could spoof reply messages on the internal IPC channel used by `webContents.executeJavaScript()` and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of `webContents.executeJavaScript()` (or `webFrameMain.executeJavaScript()`) in security-sensitive decisions.

### Workarounds
Do not trust the return value of `webContents.executeJavaScript()` for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xj5x-m3f3-5x3h
Package: electron (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Service worker can spoof executeJavaScript IPC replies

Details:
### Impact
A service worker running in a session could spoof reply messages on the internal IPC channel used by `webContents.executeJavaScript()` and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of `webContents.executeJavaScript()` (or `webFrameMain.executeJavaScript()`) in security-sensitive decisions.

### Workarounds
Do not trust the return value of `webContents.executeJavaScript()` for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-r5p7-gp4j-qhrx
Package: electron (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: Incorrect origin passed to permission request handler for iframe requests

Details:
### Impact
When an iframe requests `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions, the origin passed to `session.setPermissionRequestHandler()` was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or `webContents.getURL()` may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via `details.requestingUrl`. Apps that already check `details.requestingUrl` are not affected.

### Workarounds
In your `setPermissionRequestHandler`, inspect `details.requestingUrl` rather than the origin parameter or `webContents.getURL()` when deciding whether to grant `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-r5p7-gp4j-qhrx
Package: electron (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.1
Patched in: 40.8.1

Summary: Electron: Incorrect origin passed to permission request handler for iframe requests

Details:
### Impact
When an iframe requests `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions, the origin passed to `session.setPermissionRequestHandler()` was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or `webContents.getURL()` may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via `details.requestingUrl`. Apps that already check `details.requestingUrl` are not affected.

### Workarounds
In your `setPermissionRequestHandler`, inspect `details.requestingUrl` rather than the origin parameter or `webContents.getURL()` when deciding whether to grant `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-r5p7-gp4j-qhrx
Package: electron (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: Incorrect origin passed to permission request handler for iframe requests

Details:
### Impact
When an iframe requests `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions, the origin passed to `session.setPermissionRequestHandler()` was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or `webContents.getURL()` may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via `details.requestingUrl`. Apps that already check `details.requestingUrl` are not affected.

### Workarounds
In your `setPermissionRequestHandler`, inspect `details.requestingUrl` rather than the origin parameter or `webContents.getURL()` when deciding whether to grant `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-r5p7-gp4j-qhrx
Package: electron (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Incorrect origin passed to permission request handler for iframe requests

Details:
### Impact
When an iframe requests `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions, the origin passed to `session.setPermissionRequestHandler()` was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or `webContents.getURL()` may inadvertently grant permissions to embedded third-party content.

The correct requesting URL remains available via `details.requestingUrl`. Apps that already check `details.requestingUrl` are not affected.

### Workarounds
In your `setPermissionRequestHandler`, inspect `details.requestingUrl` rather than the origin parameter or `webContents.getURL()` when deciding whether to grant `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-3c8v-cfp5-9885
Package: electron (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Details:
### Impact
On macOS and Linux, apps that call `app.requestSingleInstanceLock()` were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's `second-instance` event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call `app.requestSingleInstanceLock()` are not affected. Windows is not affected by this issue.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-3c8v-cfp5-9885
Package: electron (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.1
Patched in: 40.8.1

Summary: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Details:
### Impact
On macOS and Linux, apps that call `app.requestSingleInstanceLock()` were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's `second-instance` event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call `app.requestSingleInstanceLock()` are not affected. Windows is not affected by this issue.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-3c8v-cfp5-9885
Package: electron (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.1
Patched in: 39.8.1

Summary: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Details:
### Impact
On macOS and Linux, apps that call `app.requestSingleInstanceLock()` were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's `second-instance` event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call `app.requestSingleInstanceLock()` are not affected. Windows is not affected by this issue.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-3c8v-cfp5-9885
Package: electron (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Details:
### Impact
On macOS and Linux, apps that call `app.requestSingleInstanceLock()` were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's `second-instance` event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call `app.requestSingleInstanceLock()` are not affected. Windows is not affected by this issue.

### Workarounds
There are no app side workarounds, developers must update to a patched version of Electron.

### Fixed Versions
* `41.0.0`
* `40.8.1`
* `39.8.1`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xwr5-m59h-vwqr
Package: electron (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Details:
### Impact
The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration.

Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected.

### Workarounds
Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences.

### Fixed Versions
* `41.0.0`
* `40.8.4`
* `39.8.4`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xwr5-m59h-vwqr
Package: electron (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.4
Patched in: 40.8.4

Summary: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Details:
### Impact
The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration.

Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected.

### Workarounds
Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences.

### Fixed Versions
* `41.0.0`
* `40.8.4`
* `39.8.4`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xwr5-m59h-vwqr
Package: electron (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: >= 39.0.0-alpha.1, < 39.8.4
Patched in: 39.8.4

Summary: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Details:
### Impact
The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration.

Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected.

### Workarounds
Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences.

### Fixed Versions
* `41.0.0`
* `40.8.4`
* `39.8.4`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-xwr5-m59h-vwqr
Package: electron (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 38.8.6
Patched in: 38.8.6

Summary: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Details:
### Impact
The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration.

Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected.

### Workarounds
Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences.

### Fixed Versions
* `41.0.0`
* `40.8.4`
* `39.8.4`
* `38.8.6`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-532v-xpq5-8h95
Package: electron (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 41.0.0-alpha.1, < 41.0.0
Patched in: 41.0.0

Summary: Electron: Use-after-free in offscreen child window paint callback

Details:
### Impact
Apps that use offscreen rendering and allow child windows via `window.open()` may be vulnerable to a use-after-free. If the parent offscreen `WebContents` is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (`webPreferences.offscreen: true`) and their `setWindowOpenHandler` permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

### Workarounds
Deny child window creation from offscreen renderers in your `setWindowOpenHandler`, or ensure child windows are closed before the parent is destroyed.

### Fixed Versions
* `41.0.0`
* `40.7.0`
* `39.8.1`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-532v-xpq5-8h95
Package: electron (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-416: Use After Free
Vulnerable versions: >= 40.0.0-alpha.1, < 40.7.0
Patched in: 40.7.0

Summary: Electron: Use-after-free in offscreen child window paint callback

Details:
### Impact
Apps that use offscreen rendering and allow child windows via `window.open()` may be vulnerable to a use-after-free. If the parent offscreen `WebContents` is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (`webPreferences.offscreen: true`) and their `setWindowOpenHandler` permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

### Workarounds
Deny child window creation from offscreen renderers in your `setWindowOpenHandler`, or ensure child windows are closed before the parent is destroyed.

### Fixed Versions
* `41.0.0`
* `40.7.0`
* `39.8.1`

### For more information
If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)