GHSA-f2r8-jv7c-xqmp: OS Command Injection
Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend (such as a malicious DevTools extension) could use this to execute native code outside the sandbox.
Apps are only affected if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. Apps that do not open DevTools in that context are not affected.
Workarounds Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.2 39.8.9
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0-beta.3 - Configuration
Do not open DevTools for windows that load untrusted content.
Electron DevTools open DevTools for windows exposed to untrusted content = false - Configuration
Do not load untrusted DevTools extensions.
Electron DevTools load DevTools extensions = trusted-only