Description
Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.
Recommendation
Update the Electron package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.7.0, < 1.7.6
- Patched version(s): 1.7.6
References
Related Issues
- URIjs Vulnerable to Hostname spoofing via backslashes in URL - CVE-2021-3647
- s3-url-parser vulnerable to Denial of Service via regexes component - CVE-2024-25355
- URIjs Hostname spoofing via backslashes in URL - CVE-2021-27516
- Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker - CVE-2026-42553
You might also like:
- Tags:
- npm
- Electron
Anything's wrong? Let us know Last updated on September 13, 2023