electron: Security Threat Details
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- electron (npm)
- Affected versions
- >= 8.0.0-beta.0, < 8.5.1 or >= 9.0.0-beta.0, < 9.3.0 or >= 10.0.0-beta.0, < 10.0.1 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.1 or >= 41.0.0-alpha.1, < 41.0.0 or < 13.6.6 or >= 14.0.0-beta.1, < 14.2.4 or >= 15.0.0-beta.1, < 15.3.5 or >= 16.0.0-beta.1, < 16.0.6 or >= 17.0.0-alpha.1, < 17.0.0-alpha.6 or < 39.8.7 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.0 or >= 42.0.0-alpha.1, < 42.0.0-beta.1 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.3 or >= 40.0.0-alpha.1, < 40.8.3 or >= 41.0.0-alpha.1, < 41.0.3 or < 1.6.14 or >= 1.7.0, < 1.7.8 or < 39.8.1 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0 or >= 8.0.0-beta.0, < 8.5.2 or >= 9.0.0-beta.0, < 9.3.1 or >= 10.0.0-beta.0, < 10.1.2 or >= 11.0.0-beta.0, < 11.0.0-beta.6 or >= 42.0.0-alpha.1, < 42.0.0-beta.1 or >= 41.0.0-alpha.1, < 41.1.1 or >= 40.0.0-alpha.1, < 40.9.0 or < 39.8.6 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or >= 1.7.0, < 1.7.6 or < 28.3.2 or >= 29.0.0-alpha.1, < 29.3.3 or >= 30.0.0-alpha.1, < 30.0.3 or < 6.1.11 or >= 7.0.0, < 7.2.4 or >= 8.0.0, < 8.2.4 or < 15.5.0 or >= 16.0.0, < 16.2.0 or >= 17.0.0, < 17.2.0 or >= 18.0.0-beta.1, < 18.0.0-beta.6 or < 1.6.8 or < 22.3.24 or >= 24.0.0-alpha.1, < 24.8.3 or >= 25.0.0-alpha.1, < 25.8.1 or >= 26.0.0-alpha.1, < 26.2.1 or >= 27.0.0-alpha.1, < 27.0.0-alpha.7 or >= 23.0.0-alpha.1, <= 23.3.13 or < 22.3.19 or >= 23.0.0-alpha.1, < 23.3.13 or >= 24.0.0-alpha.1, < 24.7.1 or >= 25.0.0-alpha.1, < 25.5.0 or >= 26.0.0-alpha.1, < 26.0.0-beta.13 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.0 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or >= 33.0.0-alpha.1, < 39.8.5 or >= 40.0.0-alpha.1, < 40.8.5 or >= 41.0.0-alpha.1, < 41.1.0 or >= 42.0.0-alpha.1, < 42.0.0-alpha.5 or >= 1.7.0, < 1.7.13 or >= 1.8.0, < 1.8.4 or >= 2.0.0-beta.1, < 2.0.0-beta.5 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.0 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or >= 19.0.0, < 19.1.8 or >= 42.0.0-alpha.1, < 42.0.1 or >= 40.0.0-alpha.1, < 41.10.3 or < 39.8.10 or < 39.8.7 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.0 or >= 42.0.0-alpha.1, < 42.0.0-beta.1 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.0 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.7 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.0 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or < 39.8.9 or >= 40.0.0-alpha.1, < 40.9.2 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 39.8.5 or >= 40.0.0-alpha.1, < 40.8.5 or >= 41.0.0-alpha.1, < 41.1.0 or >= 42.0.0-alpha.1, < 42.0.0-alpha.5 or < 39.8.5 or >= 40.0.0-alpha.1, < 40.8.5 or >= 41.0.0-alpha.1, < 41.1.0 or >= 42.0.0-alpha.1, < 42.0.0-alpha.5 or < 7.2.4 or >= 8.0.0, < 8.2.4 or < 39.8.9 or >= 40.0.0-alpha.1, < 40.9.2 or >= 41.0.0-alpha.1, < 41.2.2 or >= 42.0.0-alpha.1, < 42.0.0-beta.4 or < 1.8.2-beta5 or < 0.33.5 or >= 22.0.0-beta.1, < 22.0.1 or >= 23.0.0-alpha.1, < 23.0.0-alpha.2 or < 39.8.9 or >= 40.0.0-alpha.1, < 40.9.2 or >= 41.0.0-alpha.1, < 41.2.2 or >= 42.0.0-alpha.1, < 42.0.0-beta.5 or < 7.2.4 or >= 8.0.0, < 8.2.4 or >= 1.7.0, < 1.7.16 or >= 1.8.0, < 1.8.8 or >= 2.0.0, < 2.0.8 or >= 3.0.0-beta.1, < 3.0.0-beta.7 or < 9.4.0 or >= 10.0.0, < 10.2.0 or >= 11.0.0, < 11.1.0 or >= 22.0.0, < 22.3.24 or >= 24.0.0, < 24.8.3 or >= 25.0.0, < 25.8.1 or >= 26.0.0, < 26.2.1 or >= 27.0.0-beta.1, < 27.0.0-beta.2 or >= 39.0.0-alpha.1, < 39.8.0 or >= 40.0.0-alpha.1, < 40.7.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.0 or >= 41.0.0-alpha.1, < 41.0.0-beta.8 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.1 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 7.2.4 or >= 8.0.0, < 8.2.4 or < 11.5.0 or >= 12.0.0, < 12.1.0 or >= 13.0.0, < 13.3.0 or < 15.5.5 or >= 16.0.0, < 16.2.6 or >= 17.0.0, < 17.2.0 or >= 18.0.0-beta.1, < 18.0.0-beta.6 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.1 or >= 41.0.0-alpha.1, < 41.0.0 or < 18.3.7 or >= 20.0.0-beta.1, < 20.0.1 or >= 19.0.0-beta.1, < 19.0.11 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 22.3.6 or >= 23.0.0-alpha.1, < 23.2.3 or >= 24.0.0-alpha.1, < 24.0.1 or >= 25.0.0-alpha.1, < 25.0.0-alpha.2 or < 39.8.10 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or >= 42.3.1, < 42.3.3 or < 22.3.25 or >= 24.0.0, < 24.8.5 or >= 25.0.0, < 25.8.4 or >= 26.0.0, < 26.2.4 or >= 27.0.0-alpha.1, < 27.0.0-beta.8 or >= 43.0.0-alpha.1, < 43.0.0 or >= 42.0.0-alpha.1, < 42.5.1 or >= 41.0.0-alpha.1, < 41.9.1 or >= 40.0.0-alpha.1, < 40.10.6 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.1 or >= 41.0.0-alpha.1, < 41.0.0 or >= 42.0.0-alpha.1, < 42.0.0 or >= 41.0.0-alpha.1, < 41.4.0 or >= 40.0.0-alpha.1, < 40.9.3 or < 39.8.10 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.1 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.0 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 35.7.5 or >= 36.0.0-alpha.1, < 36.8.1 or >= 37.0.0-alpha.1, < 37.3.1 or >= 38.0.0-alpha.1, < 38.0.0-beta.6 or >= 1.7.0, < 1.7.11 or >= 1.6.0, < 1.6.16 or >= 1.8.0, < 1.8.2-beta.4 or < 39.8.8 or >= 40.0.0-alpha.1, < 40.9.1 or >= 41.0.0-alpha.1, < 41.2.1 or >= 42.0.0-alpha.1, < 42.0.0-beta.3 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.1 or >= 40.0.0-alpha.1, < 40.8.1 or >= 41.0.0-alpha.1, < 41.0.0 or >= 30.0.0-alpha.1, < 30.0.5 or >= 31.0.0-alpha.1, < 31.0.0-beta.1 or < 38.8.6 or >= 39.0.0-alpha.1, < 39.8.4 or >= 40.0.0-alpha.1, < 40.8.4 or >= 41.0.0-alpha.1, < 41.0.0
- Patched version
- 42.0.0-beta.1 || 41.2.0 || 40.9.0 || 39.8.7
GHSA-4F78-QHMW-8J8M
The Electron npm package has a vulnerability where the `mode` option of `webContents.openDevTools()` was not sanitized, allowing scripts under attacker control to run in the DevTools context. This affects unsandboxed configurations with access to Node.js. This is an early warning and is not yet fully confirmed; consult the primary sources below for the latest verified detail.
What happened
The Electron npm package has a vulnerability where the `mode` option of `webContents.openDevTools()` was not sanitized, allowing scripts under attacker control to run in the DevTools context. This affects unsandboxed configurations with access to Node.js.
If your organisation depends on electron, directly or as a transitive dependency, review the affected versions against the primary sources below and treat any matching installation as suspect until verified.
What to do about it
- Upgrade to Electron version 42.0.0-beta.1, 41.2.0, 40.9.0, or 39.8.7 and ensure only fixed, allowlisted values are passed to the `mode` argument of `openDevTools()`.
- Compare electron against your own dependency list, including transitive dependencies, to check whether it is present.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
electron is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.