Nixpkgs security tracker
5.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Electron: Sandboxed iframes can launch external protocol handlers
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
References
-
https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp x_refsource_CONFIRM
-
https://github.com/electron/electron/pull/50961 x_refsource_MISC
-
https://github.com/electron/electron/pull/50962 x_refsource_MISC
-
https://github.com/electron/electron/pull/50963 x_refsource_MISC
-
https://github.com/electron/electron/pull/50964 x_refsource_MISC
-
https://github.com/electron/electron/releases/tag/v39.8.8 x_refsource_MISC
-
https://github.com/electron/electron/releases/tag/v40.9.0 x_refsource_MISC
-
https://github.com/electron/electron/releases/tag/v41.2.1 x_refsource_MISC
-
https://github.com/electron/electron/releases/tag/v42.0.0-beta.3 x_refsource_MISC
Affected products
- ==>= 40.0.0-alpha.1, < 40.9.0
- ==>= 41.0.0-alpha.1, < 41.2.1
- ==< 39.8.8
- ==>= 42.0.0-alpha.1, < 42.0.0-beta.3
Matching in nixpkgs
pkgs.electron
Cross platform desktop application shell
pkgs.electron_38
None
pkgs.electron_39
Cross platform desktop application shell
pkgs.electron_40
Cross platform desktop application shell
pkgs.electron_41
Cross platform desktop application shell
pkgs.electron_42
Cross platform desktop application shell
pkgs.electron_43
Cross platform desktop application shell
pkgs.electron-bin
Cross platform desktop application shell
pkgs.electron-cash
Bitcoin Cash SPV Wallet
pkgs.electron-mail
Unofficial Election-based ProtonMail desktop client
pkgs.electron-fiddle
Easiest way to get started with Electron
pkgs.electron_38-bin
None
pkgs.electron_39-bin
Cross platform desktop application shell
pkgs.electron_40-bin
Cross platform desktop application shell
pkgs.electron_41-bin
Cross platform desktop application shell
pkgs.electron_42-bin
Cross platform desktop application shell
pkgs.electron_43-bin
Cross platform desktop application shell
pkgs.todoist-electron
To-Do List App & Task Manager
pkgs.jitsi-meet-electron
Jitsi Meet desktop application powered by Electron
pkgs.electron-chromedriver
WebDriver server for running Selenium tests on Chrome
pkgs.idrisPackages.electron
Electron bindings for Idris
-
nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
-
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07
pkgs.electron-chromedriver_38
None
pkgs.electron-chromedriver_39
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_40
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_41
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_42
WebDriver server for running Selenium tests on Chrome
pkgs.electron-chromedriver_43
WebDriver server for running Selenium tests on Chrome
Package maintainers
-
@TomaSajt TomaSajt
-
@yayayayaka Yaya <github@uwu.is>
-
@teutat3s teutat3s <teutates@mailbox.org>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@oxalica oxalica <oxalicc@pm.me>
-
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
-
@andersk Anders Kaseorg <andersk@mit.edu>
-
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
-
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
-
@brainrake Marton Boros <martonboros@gmail.com>
-
@ryantm Ryan Mulligan <ryan@ryantm.com>
-
@Lassulus Lassulus <lassulus@gmail.com>
-
@novmar Marcel Novotny <novotny@marnov.cz>
-
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
-
@pokon548 Bu Kun <nix@bukn.uk>