Affected versions of electron
may be susceptible to a remote code execution flaw when certain conditions are met:
- The electron application is running on Windows.
- The electron application registers as the default handler for a protocol, such as
nodeapp://
.
This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.
MacOS and Linux are not vulnerable.
Recommendation
Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:
If for some reason you are unable to upgrade your Electron version, you can append --
as the last argument when calling app.setAsDefaultProtocolClient
, which prevents Chromium from parsing further options. The double dash --
signifies the end of command options, after which only positional parameters are accepted.
app.setAsDefaultProtocolClient(protocol, process.execPath, [
'--your-switches-here',
'--'
])
References
Affected versions of
electron
may be susceptible to a remote code execution flaw when certain conditions are met:nodeapp://
.This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.
MacOS and Linux are not vulnerable.
Recommendation
Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:
If for some reason you are unable to upgrade your Electron version, you can append
--
as the last argument when callingapp.setAsDefaultProtocolClient
, which prevents Chromium from parsing further options. The double dash--
signifies the end of command options, after which only positional parameters are accepted.References