Vulnerability Description
The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Electronjs | Electron | >= 9.0.0, < 9.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edPatchThird Party Advisory
- https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49
- https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371d
- https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797
- https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9
- https://github.com/electron/electron/pull/26875Third Party Advisory
- https://github.com/electron/electron/releases/tag/v9.4.0Release NotesThird Party Advisory
- https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9Third Party Advisory
- https://www.electronjs.org/releases/stable?version=9#9.4.0Release NotesVendor Advisory
- https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edPatchThird Party Advisory
- https://github.com/electron/electron/pull/26875Third Party Advisory
- https://github.com/electron/electron/releases/tag/v9.4.0Release NotesThird Party Advisory
- https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9Third Party Advisory
- https://www.electronjs.org/releases/stable?version=9#9.4.0Release NotesVendor Advisory
FAQ
What is CVE-2020-26272?
CVE-2020-26272 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent...
How severe is CVE-2020-26272?
CVE-2020-26272 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-26272?
Check the references section above for vendor advisories and patch information. Affected products include: Electronjs Electron.