GHSA-gr2m-v5gq-v685
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Quick fix
GHSA-gr2m-v5gq-v685 — electron: upgrade to the fixed version with the command below.
npm install electron@41.10.6Details
### Impact
Windows opened from a sandboxed top-level document did not inherit that document's HTML `sandbox` restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.
Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with `setWindowOpenHandler` are not affected.
### Workarounds
Return `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content.
### Fixed Versions
* `44.0.0-beta.5` * `43.4.1` * `42.9.2` * `41.10.6`
### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Are you affected?
Enter the version of the package you're using.
Affected packages
44.0.0-alpha.1Fixed in: 44.0.0-beta.5npm install electron@44.0.0-beta.5References
- https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685[WEB]
- https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2[WEB]
- https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d[WEB]
- https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886[WEB]
- https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a[WEB]
- https://github.com/electron/electron[PACKAGE]
- https://github.com/electron/electron/releases/tag/v41.10.6[WEB]
- https://github.com/electron/electron/releases/tag/v42.9.2[WEB]
- https://github.com/electron/electron/releases/tag/v43.4.1[WEB]
- https://github.com/electron/electron/releases/tag/v44.0.0-beta.5[WEB]