Vulnerabilities > CVE-2023-39956 - Unspecified vulnerability in Electronjs Electron

CVSS 6.6 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

HIGH

Availability impact

LOW

local

low complexity

electronjs

NVD

Published: 2023-09-06

Updated: 2024-11-21

Summary

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.

Vulnerable Configurations

Part	Description	Count
Application	Electronjs Electronjs Electron 25.0.0 Electronjs Electron 25.0.1 Electronjs Electron 25.1.0 Electronjs Electron 25.1.1 Electronjs Electron 25.2.0 Electronjs Electron 25.2.1 Electronjs Electron 25.3.0 Electronjs Electron 25.3.1 Electronjs Electron 25.3.2 Electronjs Electron 25.4.0 Electronjs Electron 24.0.0 Electronjs Electron 24.1.0 Electronjs Electron 24.1.1 Electronjs Electron 24.1.2 Electronjs Electron 24.1.3 Electronjs Electron 24.2.0 Electronjs Electron 24.3.0 Electronjs Electron 24.3.1 Electronjs Electron 24.4.0 Electronjs Electron 24.4.1 Electronjs Electron 24.5.0 Electronjs Electron 24.5.1 Electronjs Electron 24.6.0 Electronjs Electron 24.6.1 Electronjs Electron 24.6.2 Electronjs Electron 24.6.3 Electronjs Electron 24.6.4 Electronjs Electron 24.6.5 Electronjs Electron 24.7.0 Electronjs Electron 23.0.0 Electronjs Electron 23.1.0 Electronjs Electron 23.1.1 Electronjs Electron 23.1.2 Electronjs Electron 23.1.3 Electronjs Electron 23.1.4 Electronjs Electron 23.2.0 Electronjs Electron 23.2.1 Electronjs Electron 23.2.2 Electronjs Electron 23.2.3 Electronjs Electron 23.2.4 Electronjs Electron 23.3.0 Electronjs Electron 23.3.1 Electronjs Electron 23.3.2 Electronjs Electron 23.3.3 Electronjs Electron 23.3.4 Electronjs Electron 23.3.5 Electronjs Electron 23.3.6 Electronjs Electron 23.3.7 Electronjs Electron 23.3.8 Electronjs Electron 23.3.9 Electronjs Electron 23.3.10 Electronjs Electron 23.3.11 Electronjs Electron 23.3.12 Electronjs Electron 1.7.8 Electronjs Electron 18.0.2 Electronjs Electron 18.0.3 Electronjs Electron 18.0.4 Electronjs Electron 18.1.0 Electronjs Electron 18.2.0 Electronjs Electron 18.2.2 Electronjs Electron 18.2.3 Electronjs Electron 18.2.4 Electronjs Electron 18.3.0 Electronjs Electron 18.3.1 Electronjs Electron 18.3.2 Electronjs Electron 18.3.3 Electronjs Electron 18.3.4 Electronjs Electron 18.3.5 Electronjs Electron 18.3.6 Electronjs Electron 18.3.7 Electronjs Electron 18.3.8 Electronjs Electron 18.3.9 Electronjs Electron 18.3.11 Electronjs Electron 18.3.12 Electronjs Electron 18.3.13 Electronjs Electron 18.3.14 Electronjs Electron 18.3.15 Electronjs Electron 19.0.0 Electronjs Electron 19.0.1 Electronjs Electron 19.0.2 Electronjs Electron 19.0.3 Electronjs Electron 19.0.4 Electronjs Electron 19.0.5 Electronjs Electron 19.0.6 Electronjs Electron 19.0.7 Electronjs Electron 19.0.8 Electronjs Electron 19.0.9 Electronjs Electron 19.0.10 Electronjs Electron 19.0.11 Electronjs Electron 19.0.12 Electronjs Electron 19.0.13 Electronjs Electron 19.0.14 Electronjs Electron 19.0.15 Electronjs Electron 19.0.16 Electronjs Electron 19.0.17 Electronjs Electron 19.1.0 Electronjs Electron 19.1.1 Electronjs Electron 19.1.2 Electronjs Electron 19.1.3 Electronjs Electron 20.0.0 Electronjs Electron 20.0.1 Electronjs Electron 20.0.2 Electronjs Electron 20.0.3 Electronjs Electron 20.1.0 Electronjs Electron 20.1.1 Electronjs Electron 20.1.2 Electronjs Electron 20.1.3 Electronjs Electron 20.1.4 Electronjs Electron 20.2.0 Electronjs Electron 20.3.0 Electronjs Electron 20.3.1 Electronjs Electron 20.3.2 Electronjs Electron 21.0.0 Electronjs Electron 21.0.1 Electronjs Electron 21.1.0 Electronjs Electron 21.1.1 Electronjs Electron 22.0.0 Electronjs Electron 22.0.1 Electronjs Electron 22.0.2 Electronjs Electron 22.0.3 Electronjs Electron 22.1.0 Electronjs Electron 22.2.0 Electronjs Electron 22.2.1 Electronjs Electron 22.3.0 Electronjs Electron 22.3.1 Electronjs Electron 22.3.2 Electronjs Electron 22.3.3 Electronjs Electron 22.3.4 Electronjs Electron 22.3.5 Electronjs Electron 22.3.6 Electronjs Electron 22.3.7 Electronjs Electron 22.3.8 Electronjs Electron 26.0.0	254

Summary

Vulnerable Configurations

References