CVE-2023-29198: Context isolation bypass via nested unserializable return value in Electron
First published: Wed Sep 06 2023(Updated: )
### Impact Apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. ### Workarounds This issue is exploitable under either of two conditions: * If an API exposed to the main world via `contextBridge` can return an object or array that contains a JS object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. * If an API exposed to the main world via `contextBridge` has a return value that throws a user-generated exception while being sent over the bridge, for instance a dynamic getter property on an object that throws an error when being computed. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are [supported](https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support) and that any objects returned from functions do not have dynamic getters that can throw exceptions. Auditing your exposed API is likely to be quite difficult so we strongly recommend you update to a patched version of Electron. ### Fixed Versions * `25.0.0-alpha.2` * `24.0.1` * `23.2.3` * `22.3.6` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Electronjs Electron | <22.3.6 | |
| Electronjs Electron | >=23.0.0<23.2.3 | |
| Electronjs Electron | =24.0.0 | |
| Electronjs Electron | =24.0.0-alpha1 | |
| Electronjs Electron | =24.0.0-alpha2 | |
| Electronjs Electron | =24.0.0-alpha3 | |
| Electronjs Electron | =24.0.0-alpha4 | |
| Electronjs Electron | =24.0.0-alpha5 | |
| Electronjs Electron | =24.0.0-alpha6 | |
| Electronjs Electron | =24.0.0-alpha7 | |
| Electronjs Electron | =24.0.0-beta1 | |
| Electronjs Electron | =24.0.0-beta2 | |
| Electronjs Electron | =24.0.0-beta3 | |
| Electronjs Electron | =24.0.0-beta4 | |
| Electronjs Electron | =24.0.0-beta5 | |
| Electronjs Electron | =24.0.0-beta6 | |
| Electronjs Electron | =24.0.0-beta7 | |
| Electronjs Electron | =25.0.0-alpha1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-29198?
CVE-2023-29198 is a vulnerability in Electron, a framework for writing cross-platform desktop applications using JavaScript.
How does CVE-2023-29198 impact applications?
CVE-2023-29198 is a context isolation bypass vulnerability in Electron, allowing code in the renderer to perform privileged actions in the isolated Electron context.
What is the severity of CVE-2023-29198?
CVE-2023-29198 has a severity rating of 8.5 (high).
Which versions of Electron are affected by CVE-2023-29198?
Electron versions up to and including 25.0.0-alpha.2 are affected by CVE-2023-29198.
How can I fix CVE-2023-29198?
You can fix CVE-2023-29198 by updating to Electron version 25.0.0-alpha.2 or later.
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-p7v2-p9m8-qqg7
- alias/CVE-2023-29198
- collector/github-advisory
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/title
- agent/last-modified-date
- agent/description
- agent/event
- vendor/electronjs
- canonical/electronjs electron
- version/electronjs electron/23.0.0
- version/electronjs electron/24.0.0
- version/electronjs electron/24.0.0-alpha1
- version/electronjs electron/24.0.0-alpha2
- version/electronjs electron/24.0.0-alpha3
- version/electronjs electron/24.0.0-alpha4
- version/electronjs electron/24.0.0-alpha5
- version/electronjs electron/24.0.0-alpha6
- version/electronjs electron/24.0.0-alpha7
- version/electronjs electron/24.0.0-beta1
- version/electronjs electron/24.0.0-beta2
- version/electronjs electron/24.0.0-beta3
- version/electronjs electron/24.0.0-beta4
- version/electronjs electron/24.0.0-beta5
- version/electronjs electron/24.0.0-beta6
- version/electronjs electron/24.0.0-beta7
- version/electronjs electron/25.0.0-alpha1
- package-manager/npm