Read the docs
TI-2022-16500 Aliases CVE-2022-36077GHSA-p2jh-44qj-pf2v

Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

Priority LOW 39CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · Low
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00688 52nd percentileScored 2026-11-07
Fix Partial electron (electron): 21.0.0-beta.1, 20.0.1, 19.0.11 +1electron (npm): 18.3.7, 20.0.1, 19.0.11Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectronv21.0.0-nightly.20220526 to before 21.0.0-beta.1; 20.0.0-beta.1 to before 20.0.1; 19.0.0-beta.1 to before 19.0.11; before 18.3.721.0.0-beta.1, 20.0.1, 19.0.11, 18.3.7Patch availableCNA
—electron (npm)before 18.3.718.3.7Patch availableGHSA-p2jh-44qj-pf2v
—electron (npm)20.0.0-beta.1 to before 20.0.120.0.1Patch availableGHSA-p2jh-44qj-pf2v
—electron (npm)19.0.0-beta.1 to before 19.0.1119.0.11Patch availableGHSA-p2jh-44qj-pf2v
  • electron Vendorelectron Affected v21.0.0-nightly.20220526 to before 21.0.0-beta.1; 20.0.0-beta.1 to before 20.0.1; 19.0.0-beta.1 to before 19.0.11; before 18.3.7 Fixed in 21.0.0-beta.1, 20.0.1, 19.0.11, 18.3.7 Patch available CNA
  • electron (npm) Vendor— Affected before 18.3.7 Fixed in 18.3.7 Patch available GHSA-p2jh-44qj-pf2v
  • electron (npm) Vendor— Affected 20.0.0-beta.1 to before 20.0.1 Fixed in 20.0.1 Patch available GHSA-p2jh-44qj-pf2v
  • electron (npm) Vendor— Affected 19.0.0-beta.1 to before 19.0.11 Fixed in 19.0.11 Patch available GHSA-p2jh-44qj-pf2v

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*before 18.3.7; 19.0.0 to before 19.0.11; 20.0.0 to before 20.0.1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:-:*:*:*:node.js:*:*21.0.0VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha1:*:*:*:node.js:*:*21.0.0 alpha1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha2:*:*:*:node.js:*:*21.0.0 alpha2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha3:*:*:*:node.js:*:*21.0.0 alpha3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha4:*:*:*:node.js:*:*21.0.0 alpha4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha5:*:*:*:node.js:*:*21.0.0 alpha5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:21.0.0:alpha6:*:*:*:node.js:*:*21.0.0 alpha6VulnerableElectronjs
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:* Versions before 18.3.7; 19.0.0 to before 19.0.11; 20.0.0 to before 20.0.1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:-:*:*:*:node.js:*:* Versions 21.0.0 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha1:*:*:*:node.js:*:* Versions 21.0.0 alpha1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha2:*:*:*:node.js:*:* Versions 21.0.0 alpha2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha3:*:*:*:node.js:*:* Versions 21.0.0 alpha3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha4:*:*:*:node.js:*:* Versions 21.0.0 alpha4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha5:*:*:*:node.js:*:* Versions 21.0.0 alpha5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:21.0.0:alpha6:*:*:*:node.js:*:* Versions 21.0.0 alpha6 Vulnerable ·Electronjs
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA electron (electron) Fixed in 21.0.0-beta.1, 20.0.1, 19.0.11, 18.3.7
  • Fix · GHSA-p2jh-44qj-pf2v electron (npm) Fixed in 18.3.7 Advisory →
  • Fix · GHSA-p2jh-44qj-pf2v electron (npm) Fixed in 20.0.1 Advisory →
  • Fix · GHSA-p2jh-44qj-pf2v electron (npm) Fixed in 19.0.11 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Not affected: 10 products
  • Red Hat A-MQ Online
  • Red Hat Application Interconnect 1.0
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7
  • Red Hat build of Apicurio Registry 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36077
  2. 2026-10-03 Alias added: GHSA-p2jh-44qj-pf2v
  3. 2026-11-05 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 1

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences