CVE-2020-15174: electronjs electron

csirt@kutim:~/threat-intel/cve/CVE-2020-15174

CVSS 7.5 · High EPSS 1,3%

Kerentanan Improper Input Validation pada electronjs electron. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

Rincian

Terbit di NVD: 6 Oktober 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-693: Protection Mechanism Failure
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
electronjs	electron	Versi 8.0.0 hingga sebelum 8.5.1
electronjs	electron	Versi 9.0.0 hingga sebelum 9.3.0
electronjs	electron	Versi 10.0.0 hingga sebelum 10.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b patch · advisory pihak ketiga
https://github.com/electron/electron/security/advisories/GHSA-2q4g-w47c-4674 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.