Executive brief
Electron, a framework used to build cross-platform desktop applications, is vulnerable to arbitrary code execution when launched with an attacker-controlled working directory. This affects command-line executables that expose entry points (e.g., `myapp --help`). An attacker with the ability to write files to the app's working directory can execute malicious code, potentially compromising the application and any data it processes. The vulnerability requires both local access and the ability to write to the target directory, limiting exposure but bypassing security features like ASAR integrity checks.
Technical details
The vulnerability is a code execution flaw (CWE-94) triggered when Electron applications launched as command-line executables operate in an attacker-controlled working directory. The root cause involves insufficient validation of the current working directory during module or resource loading, allowing an attacker to place malicious files that are subsequently loaded and executed by the application. Exploitation requires local access (AV:L), low privilege (PR:L), and user interaction (UI:R), with no scope change. The attack can result in code execution with high integrity impact (I:H) and some confidentiality and availability loss (C:L, A:L). Patches are available in versions 22.3.19, 23.3.13, 24.7.1, 25.5.0, and 26.0.0-beta.13 or later; applications must update to a patched version as there are no workarounds.
Affected products
- OpenJS Foundation Electron < 22.3.19, 23.0.0-alpha.1 to < 23.3.13, 24.0.0-alpha.1 to < 24.7.1, 25.0.0-alpha.1 to < 25.5.0, 26.0.0-alpha.1 to < 26.0.0-beta.13
Timeline
- 2023-09-06: disclosed