CVE-2021-39184: Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling contextIsolation in one's app. One may also disable the functionality of the createThumbnailFromPath API if one does not need it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 11.5.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 13.3.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 14.0.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 15.0.0-alpha.10 - Configuration
Disable/avoid using the createThumbnailFromPath API (workaround) if your app does not need it.
Electron app createThumbnailFromPath API functionality = disable - Configuration
Enable contextIsolation in your app to make exploitation significantly more difficult.
Electron app contextIsolation = enabled
Event History
Frequently Asked Questions
What is CVE-2021-39184?
CVE-2021-39184 is a vulnerability in Electron versions prior to 11.5.0, 12.1.0, and 13.3.0 that allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system.
How severe is CVE-2021-39184?
CVE-2021-39184 has a severity rating of 8.6, which is considered high.
Which versions of Electron are affected by CVE-2021-39184?
Electron versions prior to 11.5.0, 12.1.0, and 13.3.0 are affected by CVE-2021-39184.
Is there a fix for CVE-2021-39184?
Yes, updating to Electron version 11.5.0, 12.1.0, or 13.3.0 will fix the vulnerability.
Where can I find more information about CVE-2021-39184?
You can find more information about CVE-2021-39184 in the Electron GitHub pull request and security advisories: [link1](https://github.com/electron/electron/pull/30728), [link2](https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4).