Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js childprocess.execFile API call.

Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRONRUNASNODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.

Summary

AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.

This vulnerability is the same class as CVE-2024-41817.

Details

The vulnerability existed in two independent code paths within app-builder-lib (toolset 1.0.0) and through upstream dependency app-builder-bin (toolset 0.0.0).

Path 1 — Modern static runtime (AppRun generated by TypeScript)

The AppRun script generated by app-builder-lib contained this line:

bash export LDLIBRARYPATH="${APPDIR}/usr/lib:${LDLIBRARYPATH}"

When LDLIBRARYPATH is not set in the environment at launch time, this evaluates to:

/path/to/app.AppDir/usr/lib:

The trailing : is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., libfoo.so) in the directory from which the AppImage is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.

The same issue affected PATH, XDGDATADIRS, and GSETTINGSSCHEMADIR in the same script.

bash export LDLIBRARYPATH="${APPDIR}/usr/lib${LDLIBRARYPATH:+:${LDLIBRARYPATH}}"

Path 2 — Legacy FUSE2 toolset (app-builder-bin)

AppImage targets built using the legacy FUSE2 toolset (toolsets.appimage = "0.0.0") delegated AppRun script generation to the app-builder-bin Go binary, which contained the same vulnerable template:

https://github.com/develar/app-builder/blob/7004925f95d8f034fc88d7e782c9aa7583debb8e/pkg/package-format/appimage/templates/AppRun.sh#L27

Impact

An attacker with the ability to write files to the directory from which a vulnerable AppImage is executed can cause arbitrary shared libraries to be loaded into the application process, resulting in arbitrary code execution with the privileges of the user running the AppImage.

Affected Versions

This was fully resolved in app-builder-lib@26.15.0 (commit 01b8ba979, PR #9829) when app-builder-bin was removed from the dependency tree entirely and all AppImage construction was migrated to the TypeScript implementation.

Workarounds

Set LDLIBRARYPATH to a non-empty value before launching the AppImage, so that the concatenation does not produce an empty path component. Alternatively, avoid running AppImage files from world-writable directories such as /tmp.

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWEDCOMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.

Observations The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell (process.env.ComSpec on Windows, usually C:\Windows\System32\cmd.exe):

https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41

Because of the surrounding shell, a first pass by cmd.exe expands any environment variable found in command-line above.

Exploitation

This creates a situation where verifySignature() can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid.

Impact

This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.).

Patch

This vulnerability was patched in #8295, by comparing the path in the output of Get-AuthenticodeSignature with the intended one. The patch is available starting from 6.3.0-alpha.6.

Impact Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.

Patches Fixed in https://github.com/electron-userland/electron-builder/pull/8059

Workarounds None, it executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.

References https://cwe.mitre.org/data/definitions/426.html https://cwe.mitre.org/data/definitions/427

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend (such as a malicious DevTools extension) could use this to execute native code outside the sandbox.

Apps are only affected if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. Apps that do not open DevTools in that context are not affected.

Workarounds Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions.

Fixed Versions 42.0.0-beta.3 41.2.1 40.9.2 39.8.9

For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypass it and run their own code inside the signed app, inheriting its TCC permissions and keychain access.

Apps are only affected if they enable those macOS fuse-based restrictions. Apps that do not enable them are not affected.

Workarounds There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8

For more information If you have any questions or comments about this advisory, email us at security@electronjs.org

End of life: 8/20/2024, Latest version: 29.4.6

End of life: 8/20/2024, Latest version: 29.4.6

End of life: 4/16/2024, Latest version: 27.3.11

End of life: 4/16/2024, Latest version: 27.3.11

End of life: 10/15/2024, Latest version: 30.5.1

End of life: 10/15/2024, Latest version: 30.5.1

End of life: 6/11/2024, Latest version: 28.3.3

End of life: 6/11/2024, Latest version: 28.3.3

End of life: 12/5/2023, Latest version: 25.9.8

End of life: 12/5/2023, Latest version: 25.9.8

End of life: 8/15/2023, Latest version: 23.3.13

End of life: 8/15/2023, Latest version: 23.3.13

End of life: 2/20/2024, Latest version: 26.6.10

End of life: 2/20/2024, Latest version: 26.6.10

End of life: 10/10/2023, Latest version: 22.3.27

End of life: 10/10/2023, Latest version: 22.3.27

End of life: 4/4/2023, Latest version: 21.4.4

End of life: 4/4/2023, Latest version: 21.4.4