Description
Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.
Recommendation
Update the Electron package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.7.0, < 1.7.6
- Patched version(s): 1.7.6
References
Could your website be exposed too?
SmartScanner can check your website for Electron vulnerable to URL spoofing via PDFium and gives you actionable findings to investigate.
Start a free scanRelated Issues
- URIjs Vulnerable to Hostname spoofing via backslashes in URL - CVE-2021-3647
- s3-url-parser vulnerable to Denial of Service via regexes component - CVE-2024-25355
- URIjs Hostname spoofing via backslashes in URL - CVE-2021-27516
- Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker - CVE-2026-42553
You might also like:
See something that needs correcting? Let us knowUpdated September 13, 2023