CVSS 7.8 · High EPSS 0,14%
Kerentanan Unquoted Search Path or Element pada electronjs electron. Skor CVSS 3.1 7.8 (High) menurut NVD.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| electronjs | electron | Semua versi sebelum 38.8.6 |
| electronjs | electron | Versi 39.0.0 hingga sebelum 39.8.1 |
| electronjs | electron | Versi 40.0.0 hingga sebelum 40.8.0 |
| electronjs | electron | Versi 41.0.0 alpha1 |
| electronjs | electron | Versi 41.0.0 alpha2 |
| electronjs | electron | Versi 41.0.0 alpha3 |
| electronjs | electron | Versi 41.0.0 alpha4 |
| electronjs | electron | Versi 41.0.0 alpha5 |
| electronjs | electron | Versi 41.0.0 alpha6 |
| electronjs | electron | Versi 41.0.0 beta1 |
| electronjs | electron | Versi 41.0.0 beta2 |
| electronjs | electron | Versi 41.0.0 beta3 |
| electronjs | electron | Versi 41.0.0 beta4 |
| electronjs | electron | Versi 41.0.0 beta5 |
| electronjs | electron | Versi 41.0.0 beta6 |
| electronjs | electron | Versi 41.0.0 beta7 |