Read the docs
TI-2022-11788 Aliases CVE-2022-29247GHSA-mq8j-3h7h-p8g7

Exposure of Resource to Wrong Sphere in Electron

Priority MEDIUM 44CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01089 65th percentileScored 2026-11-07
Fix Fixed electron (electron): 15.5.5, 16.2.6, 17.2.0electron (npm): 15.5.5, 16.2.6, 17.2.0 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectronbefore 15.5.5; 16.0.0-beta.1 to before 16.2.6; 17.0.0-beta.1 to before 17.2.0; 18.0.0-beta.1 – 18.0.0-beta.515.5.5, 16.2.6, 17.2.0Patch availableCNA
—electron (npm)before 15.5.515.5.5Patch availableGHSA-mq8j-3h7h-p8g7
—electron (npm)16.0.0 to before 16.2.616.2.6Patch availableGHSA-mq8j-3h7h-p8g7
—electron (npm)17.0.0 to before 17.2.017.2.0Patch availableGHSA-mq8j-3h7h-p8g7
—electron (npm)18.0.0-beta.1 to before 18.0.0-beta.618.0.0-beta.6Patch availableGHSA-mq8j-3h7h-p8g7
  • electron Vendorelectron Affected before 15.5.5; 16.0.0-beta.1 to before 16.2.6; 17.0.0-beta.1 to before 17.2.0; 18.0.0-beta.1 – 18.0.0-beta.5 Fixed in 15.5.5, 16.2.6, 17.2.0 Patch available CNA
  • electron (npm) Vendor— Affected before 15.5.5 Fixed in 15.5.5 Patch available GHSA-mq8j-3h7h-p8g7
  • electron (npm) Vendor— Affected 16.0.0 to before 16.2.6 Fixed in 16.2.6 Patch available GHSA-mq8j-3h7h-p8g7
  • electron (npm) Vendor— Affected 17.0.0 to before 17.2.0 Fixed in 17.2.0 Patch available GHSA-mq8j-3h7h-p8g7
  • electron (npm) Vendor— Affected 18.0.0-beta.1 to before 18.0.0-beta.6 Fixed in 18.0.0-beta.6 Patch available GHSA-mq8j-3h7h-p8g7

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*before 15.5.5; 16.0.1 to before 16.2.6; 17.0.1 to before 17.2.0VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta1:*:*:*:*:*:*16.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta2:*:*:*:*:*:*16.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta3:*:*:*:*:*:*16.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta4:*:*:*:*:*:*16.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta5:*:*:*:*:*:*16.0.0 beta5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta6:*:*:*:*:*:*16.0.0 beta6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta7:*:*:*:*:*:*16.0.0 beta7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta8:*:*:*:*:*:*16.0.0 beta8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:16.0.0:beta9:*:*:*:*:*:*16.0.0 beta9VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* Versions before 15.5.5; 16.0.1 to before 16.2.6; 17.0.1 to before 17.2.0 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta1:*:*:*:*:*:* Versions 16.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta2:*:*:*:*:*:* Versions 16.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta3:*:*:*:*:*:* Versions 16.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta4:*:*:*:*:*:* Versions 16.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta5:*:*:*:*:*:* Versions 16.0.0 beta5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta6:*:*:*:*:*:* Versions 16.0.0 beta6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta7:*:*:*:*:*:* Versions 16.0.0 beta7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta8:*:*:*:*:*:* Versions 16.0.0 beta8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:16.0.0:beta9:*:*:*:*:*:* Versions 16.0.0 beta9 Vulnerable ·Electronjs
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:17.0.0:beta1:*:*:*:*:*:*17.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta2:*:*:*:*:*:*17.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta3:*:*:*:*:*:*17.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta4:*:*:*:*:*:*17.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta5:*:*:*:*:*:*17.0.0 beta5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta6:*:*:*:*:*:*17.0.0 beta6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta7:*:*:*:*:*:*17.0.0 beta7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta8:*:*:*:*:*:*17.0.0 beta8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:17.0.0:beta9:*:*:*:*:*:*17.0.0 beta9VulnerableElectronjs
cpe:2.3:a:electronjs:electron:18.0.0:beta1:*:*:*:*:*:*18.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:18.0.0:beta2:*:*:*:*:*:*18.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:18.0.0:beta3:*:*:*:*:*:*18.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:18.0.0:beta4:*:*:*:*:*:*18.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:18.0.0:beta5:*:*:*:*:*:*18.0.0 beta5VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta1:*:*:*:*:*:* Versions 17.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta2:*:*:*:*:*:* Versions 17.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta3:*:*:*:*:*:* Versions 17.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta4:*:*:*:*:*:* Versions 17.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta5:*:*:*:*:*:* Versions 17.0.0 beta5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta6:*:*:*:*:*:* Versions 17.0.0 beta6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta7:*:*:*:*:*:* Versions 17.0.0 beta7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta8:*:*:*:*:*:* Versions 17.0.0 beta8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:17.0.0:beta9:*:*:*:*:*:* Versions 17.0.0 beta9 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:18.0.0:beta1:*:*:*:*:*:* Versions 18.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:18.0.0:beta2:*:*:*:*:*:* Versions 18.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:18.0.0:beta3:*:*:*:*:*:* Versions 18.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:18.0.0:beta4:*:*:*:*:*:* Versions 18.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:18.0.0:beta5:*:*:*:*:*:* Versions 18.0.0 beta5 Vulnerable ·Electronjs

Remediation

  • Fix · CNA electron (electron) Fixed in 15.5.5, 16.2.6, 17.2.0
  • Fix · GHSA-mq8j-3h7h-p8g7 electron (npm) Fixed in 15.5.5 Advisory →
  • Fix · GHSA-mq8j-3h7h-p8g7 electron (npm) Fixed in 16.2.6 Advisory →
  • Fix · GHSA-mq8j-3h7h-p8g7 electron (npm) Fixed in 17.2.0 Advisory →
  • Fix · GHSA-mq8j-3h7h-p8g7 electron (npm) Fixed in 18.0.0-beta.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29247
  2. 2026-10-03 Alias added: GHSA-mq8j-3h7h-p8g7

References

Advisory 2

Other 1

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2020-03557 Context isolation bypass via contextBridge in Electron CVSS 3.1CRITICAL 9.9
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences