HIGH7.8
GHSA-gvcj-pfq2-wxj7
High severity vulnerability that affects electron
Quick fix
GHSA-gvcj-pfq2-wxj7 — electron: upgrade to the fixed version with the command below.
npm install electron@0.33.5Details
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1202[ADVISORY]
- https://github.com/electron/electron/pull/2976[WEB]
- https://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d[WEB]
- https://github.com/advisories/GHSA-gvcj-pfq2-wxj7[ADVISORY]
- https://github.com/electron/electron[PACKAGE]
- http://jvn.jp/en/jp/JVN00324715/index.html[WEB]
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000054[WEB]