HIGH7.5

GHSA-34h3-8mw4-qw57

@electron/packager's build process memory potentially leaked into final executable

Quick fix

GHSA-34h3-8mw4-qw57 — @electron/packager: upgrade to the fixed version with the command below.

npm install @electron/packager@18.3.1

Details

### Impact A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc.

### Patches This issue is patched in 18.3.1

### Workarounds No workarounds, please update to a patched version of `@electron/packager` immediately if impacated.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@electron/packager

Introduced in: 18.3.0Fixed in: 18.3.1

Fixnpm install @electron/packager@18.3.1

References

https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2024-29900[ADVISORY]
https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee[WEB]
https://github.com/electron/packager[PACKAGE]