Description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

Remediation

References

https://github.com/electron/electron/pull/10008/files

https://github.com/electron/electron/pull/10008

Related Vulnerabilities

CVE-2023-22493 Vulnerability in npm package rsshub

CVE-2020-2266 Vulnerability in maven package org.jenkins-ci.plugins:description-column-plugin

CVE-2020-5284 Vulnerability in npm package next

CVE-2019-3772 Vulnerability in maven package org.springframework.integration:spring-integration-xml

CVE-2017-16215 Vulnerability in npm package sgqserve

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Third Party Advisory NVD-CWE-noinfo