Read the docs
TI-2021-16570 Aliases CVE-2021-39184GHSA-mpjm-v997-c4h4

Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Priority LOW 39CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-668, CWE-862 and the CVSS impact.

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.

Why it matters now

EPSS 0.0105 64th percentileScored 2026-11-07
Fix Fixed electron (electron): 11.5.0, 12.1.0, 13.3.0electron (npm): 11.5.0, 12.1.0, 13.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectronbefore 11.5.0; 12.0.0 to before 12.1.0; 13.0.0 to before 13.3.011.5.0, 12.1.0, 13.3.0Patch availableCNA
—electron (npm)before 11.5.011.5.0Patch availableGHSA-mpjm-v997-c4h4
—electron (npm)12.0.0 to before 12.1.012.1.0Patch availableGHSA-mpjm-v997-c4h4
—electron (npm)13.0.0 to before 13.3.013.3.0Patch availableGHSA-mpjm-v997-c4h4
  • electron Vendorelectron Affected before 11.5.0; 12.0.0 to before 12.1.0; 13.0.0 to before 13.3.0 Fixed in 11.5.0, 12.1.0, 13.3.0 Patch available CNA
  • electron (npm) Vendor— Affected before 11.5.0 Fixed in 11.5.0 Patch available GHSA-mpjm-v997-c4h4
  • electron (npm) Vendor— Affected 12.0.0 to before 12.1.0 Fixed in 12.1.0 Patch available GHSA-mpjm-v997-c4h4
  • electron (npm) Vendor— Affected 13.0.0 to before 13.3.0 Fixed in 13.3.0 Patch available GHSA-mpjm-v997-c4h4

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*10.1.0 to before 11.5.0; 12.0.0 to before 12.1.0; 13.0.0 to before 13.3.0VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta1:*:*:*:*:*:*14.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta10:*:*:*:*:*:*14.0.0 beta10VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta11:*:*:*:*:*:*14.0.0 beta11VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta12:*:*:*:*:*:*14.0.0 beta12VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta13:*:*:*:*:*:*14.0.0 beta13VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta14:*:*:*:*:*:*14.0.0 beta14VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta15:*:*:*:*:*:*14.0.0 beta15VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta16:*:*:*:*:*:*14.0.0 beta16VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta17:*:*:*:*:*:*14.0.0 beta17VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* Versions 10.1.0 to before 11.5.0; 12.0.0 to before 12.1.0; 13.0.0 to before 13.3.0 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta1:*:*:*:*:*:* Versions 14.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta10:*:*:*:*:*:* Versions 14.0.0 beta10 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta11:*:*:*:*:*:* Versions 14.0.0 beta11 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta12:*:*:*:*:*:* Versions 14.0.0 beta12 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta13:*:*:*:*:*:* Versions 14.0.0 beta13 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta14:*:*:*:*:*:* Versions 14.0.0 beta14 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta15:*:*:*:*:*:* Versions 14.0.0 beta15 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta16:*:*:*:*:*:* Versions 14.0.0 beta16 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta17:*:*:*:*:*:* Versions 14.0.0 beta17 Vulnerable ·Electronjs
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:14.0.0:beta18:*:*:*:*:*:*14.0.0 beta18VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta19:*:*:*:*:*:*14.0.0 beta19VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta2:*:*:*:*:*:*14.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta20:*:*:*:*:*:*14.0.0 beta20VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta21:*:*:*:*:*:*14.0.0 beta21VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta22:*:*:*:*:*:*14.0.0 beta22VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta23:*:*:*:*:*:*14.0.0 beta23VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta24:*:*:*:*:*:*14.0.0 beta24VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta25:*:*:*:*:*:*14.0.0 beta25VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta3:*:*:*:*:*:*14.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta4:*:*:*:*:*:*14.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta5:*:*:*:*:*:*14.0.0 beta5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta6:*:*:*:*:*:*14.0.0 beta6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta7:*:*:*:*:*:*14.0.0 beta7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta8:*:*:*:*:*:*14.0.0 beta8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:14.0.0:beta9:*:*:*:*:*:*14.0.0 beta9VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha1:*:*:*:*:*:*15.0.0 alpha1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha2:*:*:*:*:*:*15.0.0 alpha2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha3:*:*:*:*:*:*15.0.0 alpha3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha4:*:*:*:*:*:*15.0.0 alpha4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha5:*:*:*:*:*:*15.0.0 alpha5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha6:*:*:*:*:*:*15.0.0 alpha6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha7:*:*:*:*:*:*15.0.0 alpha7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha8:*:*:*:*:*:*15.0.0 alpha8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:15.0.0:alpha9:*:*:*:*:*:*15.0.0 alpha9VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta18:*:*:*:*:*:* Versions 14.0.0 beta18 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta19:*:*:*:*:*:* Versions 14.0.0 beta19 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta2:*:*:*:*:*:* Versions 14.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta20:*:*:*:*:*:* Versions 14.0.0 beta20 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta21:*:*:*:*:*:* Versions 14.0.0 beta21 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta22:*:*:*:*:*:* Versions 14.0.0 beta22 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta23:*:*:*:*:*:* Versions 14.0.0 beta23 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta24:*:*:*:*:*:* Versions 14.0.0 beta24 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta25:*:*:*:*:*:* Versions 14.0.0 beta25 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta3:*:*:*:*:*:* Versions 14.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta4:*:*:*:*:*:* Versions 14.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta5:*:*:*:*:*:* Versions 14.0.0 beta5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta6:*:*:*:*:*:* Versions 14.0.0 beta6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta7:*:*:*:*:*:* Versions 14.0.0 beta7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta8:*:*:*:*:*:* Versions 14.0.0 beta8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:14.0.0:beta9:*:*:*:*:*:* Versions 14.0.0 beta9 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha1:*:*:*:*:*:* Versions 15.0.0 alpha1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha2:*:*:*:*:*:* Versions 15.0.0 alpha2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha3:*:*:*:*:*:* Versions 15.0.0 alpha3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha4:*:*:*:*:*:* Versions 15.0.0 alpha4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha5:*:*:*:*:*:* Versions 15.0.0 alpha5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha6:*:*:*:*:*:* Versions 15.0.0 alpha6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha7:*:*:*:*:*:* Versions 15.0.0 alpha7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha8:*:*:*:*:*:* Versions 15.0.0 alpha8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:15.0.0:alpha9:*:*:*:*:*:* Versions 15.0.0 alpha9 Vulnerable ·Electronjs

Remediation

  • Fix · CNA electron (electron) Fixed in 11.5.0, 12.1.0, 13.3.0
  • Fix · GHSA-mpjm-v997-c4h4 electron (npm) Fixed in 11.5.0 Advisory →
  • Fix · GHSA-mpjm-v997-c4h4 electron (npm) Fixed in 12.1.0 Advisory →
  • Fix · GHSA-mpjm-v997-c4h4 electron (npm) Fixed in 13.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39184
  2. 2026-10-03 Alias added: GHSA-mpjm-v997-c4h4

References

Advisory 3

Other 2

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences