Vulnerability · Published Oct 6, 2020 · Assigned by GitHub_M
CVE-2020-15174Unpreventable top-level navigation in Electron
High 7.5
In plain English
A high-severity improper input validation in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | electron | 8.5.1 | GHSA-2q4g-w47c-4674 |
| npm | electron | 9.3.0 | GHSA-2q4g-w47c-4674 |
| npm | electron | 10.0.1 | GHSA-2q4g-w47c-4674 |
Affected products (as reported)
Weakness: CWE-693, CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L