GHSA-vv43-5jgx-7qv8: Medium severity npm/electron vulnerability
Impact
On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.
Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
42.0.0-beta.2 41.10.5 39.8.10
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.10.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.10.5 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Electron applications running on macOS that ship Squirrel.Mac-based automatic updates are affected. Electron apps on other platforms, and macOS apps that do not use Squirrel.Mac auto-updates, are not affected.
What access and conditions does an attacker need?
An attacker needs local access to the macOS machine. Exploitation also requires the privileged ShipIt helper to be used during the final stage of an update, and user interaction is required according to the advisory’s vector.
What is the impact if exploitation succeeds?
A local attacker could cause the privileged ShipIt helper to overwrite files belonging to a different application rather than the application that initiated the update. Because ShipIt performs this update step as root, the overwrite occurs with root privileges.
What should teams do if they cannot patch immediately?
The advisory states that there are no application-side workarounds. The required remediation is to update Electron to a patched release: 42.0.0-beta.2, 41.10.5, or 39.8.10.