Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2020-4075

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 2.1
  • AV:L/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
electronjs / electron 9.0.0-beta11 9.0.0-beta11.x
electronjs / electron 9.0.0-beta12 9.0.0-beta12.x
electronjs / electron 9.0.0-beta13 9.0.0-beta13.x
electronjs / electron 9.0.0-beta14 9.0.0-beta14.x
electronjs / electron 9.0.0-beta15 9.0.0-beta15.x
electronjs / electron 9.0.0-beta16 9.0.0-beta16.x
electronjs / electron 9.0.0-beta17 9.0.0-beta17.x
electronjs / electron 9.0.0-beta18 9.0.0-beta18.x
electronjs / electron 9.0.0-beta19 9.0.0-beta19.x
electronjs / electron 9.0.0-beta20 9.0.0-beta20.x
electronjs / electron 9.0.0-beta1 9.0.0-beta1.x
electronjs / electron 9.0.0-beta2 9.0.0-beta2.x
electronjs / electron 9.0.0-beta3 9.0.0-beta3.x
electronjs / electron 9.0.0-beta4 9.0.0-beta4.x
electronjs / electron 9.0.0-beta5 9.0.0-beta5.x
electronjs / electron 9.0.0-beta6 9.0.0-beta6.x
electronjs / electron 9.0.0-beta7 9.0.0-beta7.x
electronjs / electron 9.0.0-beta8 9.0.0-beta8.x
electronjs / electron 9.0.0-beta9 9.0.0-beta9.x
electronjs / electron 9.0.0-beta10 9.0.0-beta10.x
electronjs / electron 9.0.0 9.0.0.x
electronjs / electron 7.0.0 7.2.4
electronjs / electron 8.0.0 8.2.4
electron - 7.2.4
electron 8.0.0 8.2.4