CVE-2023-39956— Electron: Out-of-package code execution when launched with arbitrary cwd
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-39956
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Electron: Out-of-package code execution when launched with arbitrary cwd
Source: NVD (National Vulnerability Database)
Vulnerability Description
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Electron 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Electron是个人开发者的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron存在代码注入漏洞。攻击者利用该漏洞能够将文件写入工作目录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-39956
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-39956
请登录查看更多情报信息。
- https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2023-39956
Same Patch Batch · electron · 2023-09-06 · 3 CVEs total
| CVE-2023-23623 | 7.5 HIGH | Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox d |
| CVE-2023-29198 | 6.0 MEDIUM | Context isolation bypass via nested unserializable return value in Electron |
IV. Related Vulnerabilities
Same product: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
Same vendor: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
Same weakness: CWE-94
- CVE-2021-47939
Evolution CMS 3.1.6 Authenticated Remote Code Execution via - CVE-2021-47938
ImpressCMS 1.4.2 Remote Code Execution via Autotasks - CVE-2021-47935
Sentry 8.2.0 Remote Code Execution via Pickle Deserializatio - CVE-2022-50944
Aero CMS 0.0.1 PHP Code Injection via posts.php - CVE-2026-8211
codelibs Fess JSP File AdminDesignAction.java update code in
V. Comments for CVE-2023-39956
No comments yet