Executive brief
Electron is a framework used to build desktop applications (such as Visual Studio Code, Slack, and Discord). The ASAR Integrity validation feature, when enabled, is designed to protect application code from tampering by verifying that files haven't been modified. This vulnerability allows an attacker with write access to the filesystem where the app is stored to bypass this protection and modify application code without detection, potentially enabling code injection or malware installation.
Technical details
The vulnerability is an integrity validation bypass (CWE-354) in Electron's ASAR (Asar Staging Area) integrity checking mechanism. The flaw allows attackers to modify ASAR archive contents without invalidating the integrity check, provided the attacker has write access to the filesystem containing the application bundle. The vulnerability only affects Windows; macOS deployments with the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled are unaffected. Exploitation requires local filesystem write access and the presence of both security fuses. The vulnerability has been patched in Electron 30.0.5 and 31.0.0-beta.1.
Affected products
- Electron Electron >= 30.0.0-alpha.1 < 30.0.5 || >= 31.0.0-alpha.1 < 31.0.0-beta.1
Timeline
- 2025-06-30: disclosed
- 2025-06-30: patched: Fixed in versions 30.0.5 and 31.0.0-beta.1