Read the docs
TI-2023-09452 Aliases CVE-2023-23623GHSA-gxh7-wv9q-fwfr

Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Priority MEDIUM 50CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00664 52nd percentileScored 2026-11-07
Fix Fixed electron (electron): 22.0.1, 23.0.0-alpha.2electron (npm): 22.0.1, 23.0.0-alpha.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectron22.0.0-beta.1 to before 22.0.1; 23.0.0-alpha.1 to before 23.0.0-alpha.222.0.1, 23.0.0-alpha.2Patch availableCNA
—electron (npm)22.0.0-beta.1 to before 22.0.122.0.1Patch availableGHSA-gxh7-wv9q-fwfr
—electron (npm)23.0.0-alpha.1 to before 23.0.0-alpha.223.0.0-alpha.2Patch availableGHSA-gxh7-wv9q-fwfr
  • electron Vendorelectron Affected 22.0.0-beta.1 to before 22.0.1; 23.0.0-alpha.1 to before 23.0.0-alpha.2 Fixed in 22.0.1, 23.0.0-alpha.2 Patch available CNA
  • electron (npm) Vendor— Affected 22.0.0-beta.1 to before 22.0.1 Fixed in 22.0.1 Patch available GHSA-gxh7-wv9q-fwfr
  • electron (npm) Vendor— Affected 23.0.0-alpha.1 to before 23.0.0-alpha.2 Fixed in 23.0.0-alpha.2 Patch available GHSA-gxh7-wv9q-fwfr

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:*22.0.0VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:*22.0.0 beta1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:*22.0.0 beta2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:*22.0.0 beta3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:*22.0.0 beta4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:*22.0.0 beta5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:*22.0.0 beta6VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:*22.0.0 beta7VulnerableElectronjs
cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:*22.0.0 beta8VulnerableElectronjs
cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:*23.0.0 alpha1VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:* Versions 22.0.0 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:* Versions 22.0.0 beta1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:* Versions 22.0.0 beta2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:* Versions 22.0.0 beta3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:* Versions 22.0.0 beta4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:* Versions 22.0.0 beta5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:* Versions 22.0.0 beta6 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:* Versions 22.0.0 beta7 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:* Versions 22.0.0 beta8 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:* Versions 23.0.0 alpha1 Vulnerable ·Electronjs

Remediation

  • Fix · CNA electron (electron) Fixed in 22.0.1, 23.0.0-alpha.2
  • Fix · GHSA-gxh7-wv9q-fwfr electron (npm) Fixed in 22.0.1 Advisory →
  • Fix · GHSA-gxh7-wv9q-fwfr electron (npm) Fixed in 23.0.0-alpha.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23623
  2. 2026-10-03 Alias added: GHSA-gxh7-wv9q-fwfr
  3. 2026-10-04 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 5

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
  • TI-2020-03557 Context isolation bypass via contextBridge in Electron CVSS 3.1CRITICAL 9.9
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences