6.6

CVE-2023-39956

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted.   Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance.  This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron SwPlatformnode.js Version < 22.3.9
Electronjs ≫ Electron SwPlatformnode.js Version >= 23.0.0 < 23.3.13
Electronjs ≫ Electron SwPlatformnode.js Version >= 24.0.0 < 24.7.1
Electronjs ≫ Electron SwPlatformnode.js Version >= 25.0.0 < 25.5.0
Electronjs ≫ Electron Version26.0.0 Updatealpha1 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha2 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha3 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha4 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha5 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha6 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha7 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatealpha8 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta1 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta10 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta11 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta12 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta2 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta3 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta4 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta5 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta6 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta7 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta8 SwPlatformnode.js
Electronjs ≫ Electron Version26.0.0 Updatebeta9 SwPlatformnode.js
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.073
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.6 1.8 4.7
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
security-advisories@github.com 6.1 1.3 4.7
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.