Vulnerability · Published Jul 7, 2020 · Assigned by GitHub_M

CVE-2020-4075Arbitrary file read via window-open IPC in Electron

Medium 6.8

In plain English

A medium-severity security flaw in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.2%top 32.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electron	7.2.4	GHSA-f9mq-jph6-9mhm
npm	electron	8.2.4	GHSA-f9mq-jph6-9mhm

Affected products (as reported)

Vendor	Product	Versions
electron	electron	>= 9.0.0-beta.0, <= 9.0.0-beta.20>= 8.0.0, < 8.2.4< 7.2.4

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 x_refsource_MISC
https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm x_refsource_CONFIRM