GHSA-v93f-fgjr-hjrj: Input Validation
Impact Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.
Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.
Workarounds Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Configuration
Return `{ action: 'deny' }` from `setWindowOpenHandler` for untrusted content so it cannot call `window.open()`.
Electron (BrowserWindow / setWindowOpenHandler) Return value for setWindowOpenHandler for untrusted content = { action: 'deny' } - Configuration
Supply `overrideBrowserWindowOptions` so every window option is set explicitly (avoids applying window options from untrusted `window.open()` features string without an allowlist).
Electron (BrowserWindow / setWindowOpenHandler) overrideBrowserWindowOptions = set explicitly
Event History
Frequently Asked Questions
What is the severity of GHSA-v93f-fgjr-hjrj?
The severity of GHSA-v93f-fgjr-hjrj is medium with a score of 5.3.
What are the main impacts of GHSA-v93f-fgjr-hjrj?
The main impacts of GHSA-v93f-fgjr-hjrj include untrusted content being able to set window options that could lead to unauthorized access to files.
How do I fix GHSA-v93f-fgjr-hjrj?
To fix GHSA-v93f-fgjr-hjrj, ensure that window options passed to the `BrowserWindow` are properly validated and implement an allowlist.
What software is affected by GHSA-v93f-fgjr-hjrj?
The affected software for GHSA-v93f-fgjr-hjrj is npm/electron.
What kind of vulnerability is GHSA-v93f-fgjr-hjrj classified as?
GHSA-v93f-fgjr-hjrj is classified as an Input Validation vulnerability.