CVE-2020-26272

Home/CVE/The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions

CVE

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue.

This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.

MEDIUM · CVSS 5.4 EPSS 0.00965

Monitor

No active-exploitation, high-EPSS, or public-exploit signals - routine patching cadence

Sigma rules2 YARA rules0

⬡

Weakness Classification

CWE-668Exposure of Resource to Wrong Sphere

▤

Affected Products & Versions

electronjs electron>= 9.0.0 and < 9.4.0
electronjs electron>= 10.0.0 and < 10.2.0
electronjs electron>= 11.0.0 and < 11.1.0
electronjs electronall versions

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

npm electron MODERATE fixed in 9.4.0

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

productmediumPotentially Suspicious Electron Application CommandLine

productmediumSuspicious Electron Application Child Processes

▣