CVE-2020-4075: Arbitrary file read via window-open IPC in Electron
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-4075?
CVE-2020-4075 is a vulnerability in Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21 that allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.
What is the severity of CVE-2020-4075?
The severity of CVE-2020-4075 is high with a CVSS score of 7.5.
How can I fix CVE-2020-4075?
As a workaround, ensure you are calling event.preventDefault() on all new-window events where the url or options is not trusted.
Which versions of Electron are affected by CVE-2020-4075?
Electron versions before 7.2.4, 8.2.4, and 9.0.0-beta21 are affected by CVE-2020-4075.
Where can I find more information about CVE-2020-4075?
More information about CVE-2020-4075 can be found at the following references: [GitHub Advisory](https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm), [Electron Release Notes](https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824).