Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2021-39184

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling contextIsolation in one's app. One may also disable the functionality of the createThumbnailFromPath API if one does not need it.

CVSS v3:

  • Severity: High
  • Score: 8.6
  • AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
electronjs / electron 15.0.0-alpha1 15.0.0-alpha1.x
electronjs / electron 15.0.0-alpha2 15.0.0-alpha2.x
electronjs / electron 15.0.0-alpha3 15.0.0-alpha3.x
electronjs / electron 15.0.0-alpha4 15.0.0-alpha4.x
electronjs / electron 15.0.0-alpha5 15.0.0-alpha5.x
electronjs / electron 15.0.0-alpha6 15.0.0-alpha6.x
electronjs / electron 15.0.0-alpha7 15.0.0-alpha7.x
electronjs / electron 15.0.0-alpha8 15.0.0-alpha8.x
electronjs / electron 15.0.0-alpha9 15.0.0-alpha9.x
electronjs / electron 14.0.0-beta1 14.0.0-beta1.x
electronjs / electron 14.0.0-beta2 14.0.0-beta2.x
electronjs / electron 14.0.0-beta3 14.0.0-beta3.x
electronjs / electron 14.0.0-beta4 14.0.0-beta4.x
electronjs / electron 14.0.0-beta5 14.0.0-beta5.x
electronjs / electron 14.0.0-beta6 14.0.0-beta6.x
electronjs / electron 14.0.0-beta7 14.0.0-beta7.x
electronjs / electron 14.0.0-beta8 14.0.0-beta8.x
electronjs / electron 14.0.0-beta9 14.0.0-beta9.x
electronjs / electron 14.0.0-beta10 14.0.0-beta10.x
electronjs / electron 14.0.0-beta11 14.0.0-beta11.x
electronjs / electron 14.0.0-beta12 14.0.0-beta12.x
electronjs / electron 14.0.0-beta13 14.0.0-beta13.x
electronjs / electron 14.0.0-beta14 14.0.0-beta14.x
electronjs / electron 14.0.0-beta15 14.0.0-beta15.x
electronjs / electron 14.0.0-beta16 14.0.0-beta16.x
electronjs / electron 14.0.0-beta17 14.0.0-beta17.x
electronjs / electron 14.0.0-beta18 14.0.0-beta18.x
electronjs / electron 14.0.0-beta19 14.0.0-beta19.x
electronjs / electron 14.0.0-beta20 14.0.0-beta20.x
electronjs / electron 14.0.0-beta21 14.0.0-beta21.x
electronjs / electron 14.0.0-beta22 14.0.0-beta22.x
electronjs / electron 14.0.0-beta23 14.0.0-beta23.x
electronjs / electron 14.0.0-beta24 14.0.0-beta24.x
electronjs / electron 14.0.0-beta25 14.0.0-beta25.x
electronjs / electron 13.0.0 13.3.0
electronjs / electron 12.0.0 12.1.0
electronjs / electron 10.1.0 11.5.0
electron - 11.5.0
electron 12.0.0 12.1.0
electron 13.0.0 13.3.0