CVSS 6.1 · Medium EPSS 0,45%
Kerentanan Exposure of Resource to Wrong Sphere pada electronjs electron. Skor CVSS 3.1 6.1 (Medium) menurut NVD.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| electronjs | electron | Versi 39.0.0 hingga sebelum 39.8.0 |
| electronjs | electron | Versi 40.0.0 hingga sebelum 40.7.0 |
| electronjs | electron | Versi 41.0.0 alpha1 |
| electronjs | electron | Versi 41.0.0 alpha2 |
| electronjs | electron | Versi 41.0.0 alpha3 |
| electronjs | electron | Versi 41.0.0 alpha4 |
| electronjs | electron | Versi 41.0.0 alpha5 |
| electronjs | electron | Versi 41.0.0 alpha6 |
| electronjs | electron | Versi 41.0.0 beta1 |
| electronjs | electron | Versi 41.0.0 beta2 |
| electronjs | electron | Versi 41.0.0 beta3 |
| electronjs | electron | Versi 41.0.0 beta4 |
| electronjs | electron | Versi 41.0.0 beta5 |
| electronjs | electron | Versi 41.0.0 beta6 |
| electronjs | electron | Versi 41.0.0 beta7 |