Read the docs
TI-2020-03555 Aliases CVE-2020-4075GHSA-f9mq-jph6-9mhm

Arbitrary file read via window-open IPC in Electron

Priority LOW 35CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-552.

Summary

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Why it matters now

EPSS 0.01175 67th percentileScored 2026-11-07
Fix Fixed electron (electron): 8.2.4, 7.2.4electron (npm): 7.2.4, 8.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectron9.0.0-beta.0 – 9.0.0-beta.20; 8.0.0 to before 8.2.4; before 7.2.48.2.4, 7.2.4Patch availableCNA
—electron (npm)before 7.2.47.2.4Patch availableGHSA-f9mq-jph6-9mhm
—electron (npm)8.0.0 to before 8.2.48.2.4Patch availableGHSA-f9mq-jph6-9mhm
  • electron Vendorelectron Affected 9.0.0-beta.0 – 9.0.0-beta.20; 8.0.0 to before 8.2.4; before 7.2.4 Fixed in 8.2.4, 7.2.4 Patch available CNA
  • electron (npm) Vendor— Affected before 7.2.4 Fixed in 7.2.4 Patch available GHSA-f9mq-jph6-9mhm
  • electron (npm) Vendor— Affected 8.0.0 to before 8.2.4 Fixed in 8.2.4 Patch available GHSA-f9mq-jph6-9mhm

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*7.0.0 to before 7.2.4; 8.0.0 to before 8.2.4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*9.0.0VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*9.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*9.0.0 beta10VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*9.0.0 beta11VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*9.0.0 beta12VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*9.0.0 beta13VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*9.0.0 beta14VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*9.0.0 beta15VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*9.0.0 beta16VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.2.4; 8.0.0 to before 8.2.4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:* Versions 9.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:* Versions 9.0.0 beta10 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:* Versions 9.0.0 beta11 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:* Versions 9.0.0 beta12 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:* Versions 9.0.0 beta13 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:* Versions 9.0.0 beta14 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:* Versions 9.0.0 beta15 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:* Versions 9.0.0 beta16 Vulnerable ·Electronjs
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*9.0.0 beta17VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*9.0.0 beta18VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*9.0.0 beta19VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*9.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*9.0.0 beta20VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*9.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*9.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*9.0.0 beta5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*9.0.0 beta6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*9.0.0 beta7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*9.0.0 beta8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*9.0.0 beta9VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:* Versions 9.0.0 beta17 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:* Versions 9.0.0 beta18 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:* Versions 9.0.0 beta19 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:* Versions 9.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:* Versions 9.0.0 beta20 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:* Versions 9.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:* Versions 9.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:* Versions 9.0.0 beta5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:* Versions 9.0.0 beta6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:* Versions 9.0.0 beta7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:* Versions 9.0.0 beta8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:* Versions 9.0.0 beta9 Vulnerable ·Electronjs

Remediation

  • Fix · CNA electron (electron) Fixed in 8.2.4, 7.2.4
  • Fix · GHSA-f9mq-jph6-9mhm electron (npm) Fixed in 7.2.4 Advisory →
  • Fix · GHSA-f9mq-jph6-9mhm electron (npm) Fixed in 8.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4075
  2. 2026-10-03 Alias added: GHSA-f9mq-jph6-9mhm

References

Advisory 3

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences