Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.
References
| Link | Resource |
|---|---|
| https://github.com/electron/electron/pull/30728 | Third Party Advisory |
| https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4 | Mitigation Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Aug 2022, 10:49
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 |
20 Oct 2021, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4 - Mitigation, Third Party Advisory | |
| References | (MISC) https://github.com/electron/electron/pull/30728 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 8.6 |
| CPE | cpe:2.3:a:electronjs:electron:14.0.0:beta19:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha3:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha9:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta11:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta18:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta17:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha7:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta14:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta6:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta25:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta15:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta16:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta20:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta22:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta9:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha8:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta24:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta13:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta12:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta3:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta5:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta2:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha2:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta21:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta10:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta23:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta4:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta8:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha6:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha4:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:14.0.0:beta7:*:*:*:*:*:* cpe:2.3:a:electronjs:electron:15.0.0:alpha5:*:*:*:*:*:* |
12 Oct 2021, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-12 19:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-39184
Mitre link : CVE-2021-39184
CVE.ORG link : CVE-2021-39184
JSON object : View
Products Affected
electronjs
- electron