CVE-2020-15096

Katalog CVE

CVSS 6.8 · Medium EPSS 0,81%

Kerentanan Trust Boundary Violation pada electronjs electron. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.

Rincian

Terbit di NVD

7 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-501: Trust Boundary Violation

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 release notes · advisory vendor
• https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg advisory pihak ketiga