CVE-2023-39956: Electron out-of-package code execution with arbitrary working directory

CVE-2023-39956 · Severity: low · CVSS 3.1 · Published 2023-09-06

Electron, a framework used to build cross-platform desktop applications, is vulnerable to arbitrary code execution when launched with an attacker-controlled working directory. This affects command-line executables that expose entry points (e.g., `myapp --help`). An attacker with the ability to write files to the app's working directory can execute malicious code, potentially compromising the application and any data it processes. The vulnerability requires both local access and the ability to write to the target directory, limiting exposure but bypassing security features like ASAR integrity checks.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2023-39956 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-39956 being exploited in the wild.
How severe is CVE-2023-39956?
Low severity, with a CVSS score of 3.1, published 6 September 2023.
Which products and versions are affected?
electron (npm) SEMVER:introduced=0,fixed=22.3.19.
Is there a fix for CVE-2023-39956?
Yes. electron (npm): upgrade to 22.3.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-39956 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2023-39956?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 22.3.19 or later
    npm install electron@22.3.19

Technical details

The vulnerability is a code execution flaw (CWE-94) triggered when Electron applications launched as command-line executables operate in an attacker-controlled working directory. The root cause involves insufficient validation of the current working directory during module or resource loading, allowing an attacker to place malicious files that are subsequently loaded and executed by the application. Exploitation requires local access (AV:L), low privilege (PR:L), and user interaction (UI:R), with no scope change. The attack can result in code execution with high integrity impact (I:H) and some confidentiality and availability loss (C:L, A:L). Patches are available in versions 22.3.19, 23.3.13, 24.7.1, 25.5.0, and 26.0.0-beta.13 or later; applications must update to a patched version as there are no workarounds.

Affected products

  • OpenJS Foundation Electron < 22.3.19, 23.0.0-alpha.1 to < 23.3.13, 24.0.0-alpha.1 to < 24.7.1, 25.0.0-alpha.1 to < 25.5.0, 26.0.0-alpha.1 to < 26.0.0-beta.13

Identifiers

  • CVE-2023-39956
  • GHSA-7x97-j373-85x5

Timeline

  • 2023-09-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.