Electron: Out-of-package code execution when launched with arbitrary cwd

Summary

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.

Timeline

1. Sep 6, 2023, 8:09 PM UTCCVE published
2. Sep 26, 2024, 2:44 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 26, 2024, 3:17 PM UTCRecord last updated

Affected versions

• electron electron

  fixed in 22.3.19; From 23.0.0 · fixed in 23.3.13; From 24.0.0 · fixed in 24.7.1; From 25.0.0 · fixed in 25.4.1; From 26.0.0-beta.1 · fixed in 26.0.0-beta.13

• electronnpm

  fixed in 22.3.19

• electronnpm

  From 23.0.0-alpha.1 · fixed in 23.3.13

• electronnpm

  From 24.0.0-alpha.1 · fixed in 24.7.1

• electronnpm

  From 25.0.0-alpha.1 · fixed in 25.5.0

• electronnpm

  From 26.0.0-alpha.1 · fixed in 26.0.0-beta.13

References 1