Read the docs
TI-2023-23908 Aliases CVE-2023-44402GHSA-7m48-wc93-9g85

ASAR Integrity bypass via filetype confusion in electron

Priority LOW 30CWE-345Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.

Why it matters now

EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed electron (electron): 22.3.24, 24.8.3, 25.8.1 +2electron (npm): 22.3.24, 24.8.3, 25.8.1 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectronbefore 22.3.24; 23.0.0-alpha.1 – 23.3.13; 24.0.0-alpha.1 to before 24.8.3; 25.0.0-alpha.1 to before 25.8.1; 26.0.0-alpha.1 to before 26.2.1; 27.0.0-alpha.1 to before 27.0.0-alpha.722.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-alpha.7Patch availableCNA
—electron (npm)before 22.3.2422.3.24Patch availableGHSA-7m48-wc93-9g85
—electron (npm)24.0.0-alpha.1 to before 24.8.324.8.3Patch availableGHSA-7m48-wc93-9g85
—electron (npm)25.0.0-alpha.1 to before 25.8.125.8.1Patch availableGHSA-7m48-wc93-9g85
—electron (npm)26.0.0-alpha.1 to before 26.2.126.2.1Patch availableGHSA-7m48-wc93-9g85
—electron (npm)27.0.0-alpha.1 to before 27.0.0-alpha.727.0.0-alpha.7Patch availableGHSA-7m48-wc93-9g85
—electron (npm)23.0.0-alpha.1 – 23.3.13—No fix listedGHSA-7m48-wc93-9g85
  • electron Vendorelectron Affected before 22.3.24; 23.0.0-alpha.1 – 23.3.13; 24.0.0-alpha.1 to before 24.8.3; 25.0.0-alpha.1 to before 25.8.1; 26.0.0-alpha.1 to before 26.2.1; 27.0.0-alpha.1 to before 27.0.0-alpha.7 Fixed in 22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-alpha.7 Patch available CNA
  • electron (npm) Vendor— Affected before 22.3.24 Fixed in 22.3.24 Patch available GHSA-7m48-wc93-9g85
  • electron (npm) Vendor— Affected 24.0.0-alpha.1 to before 24.8.3 Fixed in 24.8.3 Patch available GHSA-7m48-wc93-9g85
  • electron (npm) Vendor— Affected 25.0.0-alpha.1 to before 25.8.1 Fixed in 25.8.1 Patch available GHSA-7m48-wc93-9g85
  • electron (npm) Vendor— Affected 26.0.0-alpha.1 to before 26.2.1 Fixed in 26.2.1 Patch available GHSA-7m48-wc93-9g85
  • electron (npm) Vendor— Affected 27.0.0-alpha.1 to before 27.0.0-alpha.7 Fixed in 27.0.0-alpha.7 Patch available GHSA-7m48-wc93-9g85
  • electron (npm) Vendor— Affected 23.0.0-alpha.1 – 23.3.13 Fixed in — No fix listed GHSA-7m48-wc93-9g85

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*up to 22.3.24; 23.0.0 – 23.3.14; 24.0.0 – 24.8.3; 25.0.0 – 25.8.1; 26.0.0 – 26.2.1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha1:*:*:*:node.js:*:*27.0.0 alpha1VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha2:*:*:*:node.js:*:*27.0.0 alpha2VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha3:*:*:*:node.js:*:*27.0.0 alpha3VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha4:*:*:*:node.js:*:*27.0.0 alpha4VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha5:*:*:*:node.js:*:*27.0.0 alpha5VulnerableElectronjs
cpe:2.3:a:electronjs:electron:27.0.0:alpha6:*:*:*:node.js:*:*27.0.0 alpha6VulnerableElectronjs
  • cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:* Versions up to 22.3.24; 23.0.0 – 23.3.14; 24.0.0 – 24.8.3; 25.0.0 – 25.8.1; 26.0.0 – 26.2.1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha1:*:*:*:node.js:*:* Versions 27.0.0 alpha1 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha2:*:*:*:node.js:*:* Versions 27.0.0 alpha2 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha3:*:*:*:node.js:*:* Versions 27.0.0 alpha3 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha4:*:*:*:node.js:*:* Versions 27.0.0 alpha4 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha5:*:*:*:node.js:*:* Versions 27.0.0 alpha5 Vulnerable ·Electronjs
  • cpe:2.3:a:electronjs:electron:27.0.0:alpha6:*:*:*:node.js:*:* Versions 27.0.0 alpha6 Vulnerable ·Electronjs

Remediation

  • Fix · CNA electron (electron) Fixed in 22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-alpha.7
  • Fix · GHSA-7m48-wc93-9g85 electron (npm) Fixed in 22.3.24 Advisory →
  • Fix · GHSA-7m48-wc93-9g85 electron (npm) Fixed in 24.8.3 Advisory →
  • Fix · GHSA-7m48-wc93-9g85 electron (npm) Fixed in 25.8.1 Advisory →
  • Fix · GHSA-7m48-wc93-9g85 electron (npm) Fixed in 26.2.1 Advisory →
  • Fix · GHSA-7m48-wc93-9g85 electron (npm) Fixed in 27.0.0-alpha.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-44402
  2. 2026-10-03 Alias added: GHSA-7m48-wc93-9g85

References

Advisory 2

Other 3

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
  • TI-2026-39157 Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVSS 4.0CRITICAL 9.3
  • TI-2017-09308 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration… CVSS 3.0HIGH 8.1
  • TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences