*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/json-schema/package.json,/React-Basic-Video-Chat/node_modules/json-schema/package.json
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-44906
### Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/rc/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/cosmiconfig/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/sane/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/meow/node_modules/minimist/package.json
Path to dependency file: /React-Basic-Video-Chat/package.json
Path to vulnerable library: /React-Basic-Video-Chat/node_modules/minimist/package.json,/Electron-Basic-Video-Chat/node_modules/mkdirp/node_modules/minimist/package.json
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/trim-newlines/package.json,/React-Basic-Video-Chat/node_modules/trim-newlines/package.json
The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/rc/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/cosmiconfig/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/sane/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/meow/node_modules/minimist/package.json
Path to dependency file: /React-Basic-Video-Chat/package.json
Path to vulnerable library: /React-Basic-Video-Chat/node_modules/minimist/package.json,/Electron-Basic-Video-Chat/node_modules/mkdirp/node_modules/minimist/package.json
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/hosted-git-info/package.json,/React-Basic-Video-Chat/node_modules/hosted-git-info/package.json
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - electron-2.0.2.tgz
Build cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2020-4077
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Publish Date: 2020-07-07
URL: CVE-2020-4077
### CVSS 3 Score Details (9.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g
Release Date: 2020-07-13
Fix Resolution: 7.2.4
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2021-3918
### Vulnerable Library - json-schema-0.2.3.tgzJSON Schema validation and specifications
Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/json-schema/package.json,/React-Basic-Video-Chat/node_modules/json-schema/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - http-signature-1.1.1.tgz - jsprim-1.4.1.tgz - :x: **json-schema-0.2.3.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsjson-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-11-13
URL: CVE-2021-3918
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918
Release Date: 2021-11-13
Fix Resolution (json-schema): 0.4.0
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-3750
### Vulnerable Library - deep-extend-0.4.2.tgzRecursive object extending
Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.2.tgz
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - rc-1.2.1.tgz - :x: **deep-extend-0.4.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Publish Date: 2018-07-03
URL: CVE-2018-3750
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Release Date: 2018-07-03
Fix Resolution (deep-extend): 0.5.1
Direct dependency fix Resolution (electron): 2.0.3
CVE-2018-16492
### Vulnerable Library - extend-3.0.1.tgzPort of jQuery.extend for node.js and the browser
Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/extend/package.json,/React-Basic-Video-Chat/node_modules/extend/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - :x: **extend-3.0.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsA prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16492
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://hackerone.com/reports/381185
Release Date: 2019-02-01
Fix Resolution (extend): 3.0.2
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-29247
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsElectron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.
Publish Date: 2022-06-13
URL: CVE-2022-29247
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29247
Release Date: 2022-06-13
Fix Resolution: 15.5.5
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-1000620
### Vulnerable Library - cryptiles-2.0.5.tgzGeneral purpose crypto utilities
Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/cryptiles/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - hawk-3.1.3.tgz - :x: **cryptiles-2.0.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsEran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620
Release Date: 2018-07-09
Fix Resolution (cryptiles): 4.1.2
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2021-44906
### Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz### minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/rc/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/cosmiconfig/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/sane/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/meow/node_modules/minimist/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - :x: **minimist-1.2.0.tgz** (Vulnerable Library) ### minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /React-Basic-Video-Chat/package.json
Path to vulnerable library: /React-Basic-Video-Chat/node_modules/minimist/package.json,/Electron-Basic-Video-Chat/node_modules/mkdirp/node_modules/minimist/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - extract-zip-1.6.5.tgz - mkdirp-0.5.0.tgz - :x: **minimist-0.0.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsMinimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (electron): 19.0.7
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (electron): 19.0.7
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2020-4076
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Publish Date: 2020-07-07
URL: CVE-2020-4076
### CVSS 3 Score Details (9.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79
Release Date: 2020-07-13
Fix Resolution: 7.2.4
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-3728
### Vulnerable Library - hoek-2.16.3.tgzGeneral purpose node utilities
Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/hoek/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - hawk-3.1.3.tgz - :x: **hoek-2.16.3.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailshoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-03-30
URL: CVE-2018-3728
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082
Release Date: 2018-03-30
Fix Resolution (hoek): 4.2.0
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2021-33623
### Vulnerable Library - trim-newlines-1.0.0.tgzTrim newlines from the start and/or end of a string
Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/trim-newlines/package.json,/React-Basic-Video-Chat/node_modules/trim-newlines/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - pretty-bytes-1.0.4.tgz - meow-3.7.0.tgz - :x: **trim-newlines-1.0.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Publish Date: 2021-05-28
URL: CVE-2021-33623
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623
Release Date: 2021-05-28
Fix Resolution (trim-newlines): 3.0.1
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-3737
### Vulnerable Library - sshpk-1.13.1.tgzA library for finding and using SSH public keys
Library home page: https://registry.npmjs.org/sshpk/-/sshpk-1.13.1.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/sshpk/package.json,/React-Basic-Video-Chat/node_modules/sshpk/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - http-signature-1.1.1.tgz - :x: **sshpk-1.13.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailssshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Publish Date: 2018-06-07
URL: CVE-2018-3737
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://hackerone.com/reports/319593
Release Date: 2018-06-07
Fix Resolution (sshpk): 1.13.2
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-29167
### Vulnerable Library - hawk-3.1.3.tgzHTTP Hawk Authentication Scheme
Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - :x: **hawk-3.1.3.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsHawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Publish Date: 2022-05-05
URL: CVE-2022-29167
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Release Date: 2022-05-05
Fix Resolution: hawk - 9.0.1
CVE-2022-3517
### Vulnerable Library - minimatch-3.0.4.tgza glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/minimatch/package.json,/React-Basic-Video-Chat/node_modules/minimatch/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - fs-extra-0.30.0.tgz - rimraf-2.6.2.tgz - glob-7.1.2.tgz - :x: **minimatch-3.0.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
CVE-2020-4075
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Publish Date: 2020-07-07
URL: CVE-2020-4075
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm
Release Date: 2020-07-13
Fix Resolution: 7.2.4
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2020-7788
### Vulnerable Library - ini-1.3.4.tgzAn ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.4.tgz
Path to dependency file: /React-Basic-Video-Chat/package.json
Path to vulnerable library: /React-Basic-Video-Chat/node_modules/ini/package.json,/Electron-Basic-Video-Chat/node_modules/ini/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - rc-1.2.1.tgz - :x: **ini-1.3.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
### CVSS 3 Score Details (7.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): 1.3.6
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-29257
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsElectron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.
Publish Date: 2022-06-13
URL: CVE-2022-29257
### CVSS 3 Score Details (7.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97
Release Date: 2022-06-13
Fix Resolution: 15.5.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2020-15096
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.
Publish Date: 2020-07-07
URL: CVE-2020-15096
### CVSS 3 Score Details (6.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg
Release Date: 2020-07-10
Fix Resolution: 6.1.11
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-21270
### Vulnerable Library - stringstream-0.0.5.tgzEncode and decode streams into string streams
Library home page: https://registry.npmjs.org/stringstream/-/stringstream-0.0.5.tgz
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - :x: **stringstream-0.0.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsVersions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
Publish Date: 2020-12-03
URL: CVE-2018-21270
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21270
Release Date: 2020-12-03
Fix Resolution (stringstream): 0.0.6
Direct dependency fix Resolution (electron): 2.0.3
CVE-2020-7598
### Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz### minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/rc/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/cosmiconfig/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/sane/node_modules/minimist/package.json,/React-Basic-Video-Chat/node_modules/meow/node_modules/minimist/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - :x: **minimist-1.2.0.tgz** (Vulnerable Library) ### minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /React-Basic-Video-Chat/package.json
Path to vulnerable library: /React-Basic-Video-Chat/node_modules/minimist/package.json,/Electron-Basic-Video-Chat/node_modules/mkdirp/node_modules/minimist/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - extract-zip-1.6.5.tgz - mkdirp-0.5.0.tgz - :x: **minimist-0.0.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsminimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
### CVSS 3 Score Details (5.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-03-11
Fix Resolution (minimist): 1.2.3
Direct dependency fix Resolution (electron): 2.0.3
Fix Resolution (minimist): 0.2.1
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2020-15366
### Vulnerable Library - ajv-4.11.8.tgzAnother JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - har-validator-4.2.1.tgz - :x: **ajv-4.11.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAn issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
### CVSS 3 Score Details (5.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-07-15
Fix Resolution (ajv): 6.12.3
Direct dependency fix Resolution (electron): 2.0.3
CVE-2017-15010
### Vulnerable Library - tough-cookie-2.3.2.tgzRFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.3.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/tough-cookie/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - :x: **tough-cookie-2.3.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsA ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.
Publish Date: 2017-10-04
URL: CVE-2017-15010
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15010
Release Date: 2017-10-04
Fix Resolution (tough-cookie): 2.3.3
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2017-16137
### Vulnerable Libraries - debug-2.2.0.tgz, debug-2.6.8.tgz### debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/extract-zip/node_modules/debug/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - extract-zip-1.6.5.tgz - :x: **debug-2.2.0.tgz** (Vulnerable Library) ### debug-2.6.8.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.6.8.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/debug/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - :x: **debug-2.6.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137
Release Date: 2018-06-07
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (electron): 2.0.3
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2021-23362
### Vulnerable Library - hosted-git-info-2.5.0.tgzProvides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.5.0.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/hosted-git-info/package.json,/React-Basic-Video-Chat/node_modules/hosted-git-info/package.json
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - pretty-bytes-1.0.4.tgz - meow-3.7.0.tgz - normalize-package-data-2.4.0.tgz - :x: **hosted-git-info-2.5.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Publish Date: 2021-03-23
URL: CVE-2021-23362
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-43f8-2h32-f4cj
Release Date: 2021-03-23
Fix Resolution (hosted-git-info): 2.8.9
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-21718
### Vulnerable Library - electron-2.0.2.tgzBuild cross platform desktop apps with JavaScript, HTML, and CSS
Library home page: https://registry.npmjs.org/electron/-/electron-2.0.2.tgz
Path to dependency file: /Electron-Basic-Video-Chat/package.json
Path to vulnerable library: /Electron-Basic-Video-Chat/node_modules/electron/package.json
Dependency Hierarchy: - :x: **electron-2.0.2.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
Publish Date: 2022-03-22
URL: CVE-2022-21718
### CVSS 3 Score Details (5.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21718
Release Date: 2022-03-22
Fix Resolution: 13.6.6
:rescue_worker_helmet: Automatic Remediation is available for this issueWS-2018-0103
### Vulnerable Library - stringstream-0.0.5.tgzEncode and decode streams into string streams
Library home page: https://registry.npmjs.org/stringstream/-/stringstream-0.0.5.tgz
Dependency Hierarchy: - electron-2.0.2.tgz (Root Library) - electron-download-3.3.0.tgz - nugget-2.0.1.tgz - request-2.81.0.tgz - :x: **stringstream-0.0.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAll versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.
Publish Date: 2018-05-16
URL: WS-2018-0103
### CVSS 3 Score Details (4.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nodesecurity.io/advisories/664
Release Date: 2018-01-27
Fix Resolution (stringstream): 0.0.6
Direct dependency fix Resolution (electron): 2.0.3
:rescue_worker_helmet: Automatic Remediation is available for this issue.