GHSA-9qh4-3jw8-366w
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Quick fix
GHSA-9qh4-3jw8-366w — electron: upgrade to the fixed version with the command below.
npm install electron@41.10.6Details
### Impact
A `<webview>` could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.
Apps are only affected if they enable the `<webview>` tag and the embedder is unsandboxed. Apps that do not use `<webview>`, or that keep the embedder sandboxed, are not affected.
### Workarounds
Remove `nodeIntegrationInWorker` from the guest preferences in a `will-attach-webview` handler, or do not enable the `<webview>` tag when loading untrusted content.
### Fixed Versions
* `44.0.0-beta.5` * `43.4.1` * `42.9.2` * `41.10.6`
### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Are you affected?
Enter the version of the package you're using.
Affected packages
44.0.0-alpha.1Fixed in: 44.0.0-beta.5npm install electron@44.0.0-beta.5References
- https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w[WEB]
- https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2[WEB]
- https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671[WEB]
- https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886[WEB]
- https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae[WEB]
- https://github.com/electron/electron[PACKAGE]
- https://github.com/electron/electron/releases/tag/v41.10.6[WEB]
- https://github.com/electron/electron/releases/tag/v42.9.2[WEB]
- https://github.com/electron/electron/releases/tag/v43.4.1[WEB]
- https://github.com/electron/electron/releases/tag/v44.0.0-beta.5[WEB]