CVE-2020-15096

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-15096

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15096.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-15096

Aliases

GHSA-6vrv-94jv-crrg

Published

2020-07-07T00:15:10.417Z

Modified

2026-08-07T11:30:59.689742890Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*"
            ],
            "vendor_product": "electronjs:electron",
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "9.0.0-beta1"
                },
                {
                    "last_affected": "9.0.0-beta1"
                },
                {
                    "introduced": "9.0.0-beta10"
                },
                {
                    "last_affected": "9.0.0-beta10"
                },
                {
                    "introduced": "9.0.0-beta11"
                },
                {
                    "last_affected": "9.0.0-beta11"
                },
                {
                    "introduced": "9.0.0-beta12"
                },
                {
                    "last_affected": "9.0.0-beta12"
                },
                {
                    "introduced": "9.0.0-beta13"
                },
                {
                    "last_affected": "9.0.0-beta13"
                },
                {
                    "introduced": "9.0.0-beta14"
                },
                {
                    "last_affected": "9.0.0-beta14"
                },
                {
                    "introduced": "9.0.0-beta15"
                },
                {
                    "last_affected": "9.0.0-beta15"
                },
                {
                    "introduced": "9.0.0-beta16"
                },
                {
                    "last_affected": "9.0.0-beta16"
                },
                {
                    "introduced": "9.0.0-beta17"
                },
                {
                    "last_affected": "9.0.0-beta17"
                },
                {
                    "introduced": "9.0.0-beta18"
                },
                {
                    "last_affected": "9.0.0-beta18"
                },
                {
                    "introduced": "9.0.0-beta19"
                },
                {
                    "last_affected": "9.0.0-beta19"
                },
                {
                    "introduced": "9.0.0-beta2"
                },
                {
                    "last_affected": "9.0.0-beta2"
                },
                {
                    "introduced": "9.0.0-beta20"
                },
                {
                    "last_affected": "9.0.0-beta20"
                },
                {
                    "introduced": "9.0.0-beta3"
                },
                {
                    "last_affected": "9.0.0-beta3"
                },
                {
                    "introduced": "9.0.0-beta4"
                },
                {
                    "last_affected": "9.0.0-beta4"
                },
                {
                    "introduced": "9.0.0-beta5"
                },
                {
                    "last_affected": "9.0.0-beta5"
                },
                {
                    "introduced": "9.0.0-beta6"
                },
                {
                    "last_affected": "9.0.0-beta6"
                },
                {
                    "introduced": "9.0.0-beta7"
                },
                {
                    "last_affected": "9.0.0-beta7"
                },
                {
                    "introduced": "9.0.0-beta8"
                },
                {
                    "last_affected": "9.0.0-beta8"
                },
                {
                    "introduced": "9.0.0-beta9"
                },
                {
                    "last_affected": "9.0.0-beta9"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/electron/electron

Affected ranges

Type

GIT

Repo

https://github.com/electron/electron

Events

Introduced

Fixed

aa863bc323d8ddfcae9e1211d9c2cb05f1f77c46

Introduced

3083693e67632720b8d12b32d3811be0f4336318

Fixed

0552e0d5de46ffa3b481d741f1db5c779e201565

Introduced

1af3a71fdbb3130fd581b12d8f5a7440e7a04fc6

Fixed

d8f90444aa654f886016a22cb771df99c3616178

Introduced

4da01641ce50cf5a8b6f39717e4c447f89455dfa

Last affected

4da01641ce50cf5a8b6f39717e4c447f89455dfa

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.1.1"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.2.4"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.2.4"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        }
    ]
}

Affected versions

9.*

9.0.0-NA

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.11.0

v0.11.1

v0.11.10

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.11.8

v0.11.9

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.15.4

v0.15.5

v0.15.6

v0.15.7

v0.15.8

v0.15.9

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.18.0

v0.18.1

v0.18.2

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.2.0

v0.2.1

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.20.6

v0.20.7

v0.20.8

v0.21.0

v0.21.1

v0.21.2

v0.21.3

v0.22.0

v0.22.1

v0.22.2

v0.22.3

v0.23.0

v0.24.0

v0.25.0

v0.25.1

v0.25.2

v0.25.3

v0.26.0

v0.26.1

v0.27.0

v0.27.1

v0.27.2

v0.27.3

v0.28.0

v0.28.1

v0.28.2

v0.28.3

v0.29.0

v0.29.1

v0.29.2

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.30.0

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.30.5

v0.31.0

v0.31.1

v0.31.2

v0.32.0

v0.32.1

v0.32.2

v0.32.3

v0.33.0

v0.33.1

v0.33.2

v0.33.3

v0.33.4

v0.33.7

v0.33.8

v0.33.9

v0.34.0

v0.34.1

v0.34.2

v0.34.3

v0.35.0

v0.35.1

v0.35.2

v0.35.3

v0.35.4

v0.36.0

v0.36.1

v0.36.10

v0.36.11

v0.36.2

v0.36.3

v0.36.4

v0.36.5

v0.36.6

v0.36.7

v0.36.8

v0.36.9

v0.37.0

v0.37.1

v0.37.2

v0.37.3

v0.37.4

v0.37.5

v0.37.6

v0.37.7

v0.37.8

v0.4.0

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v1.*

v1.0.2

v1.1.0

v1.1.1

v1.1.2

v1.2.0

v1.2.1

v1.2.2

v1.2.3

v1.2.4

v1.2.5

v1.2.6

v1.2.7

v1.2.8

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.3.6

v1.4.0

v1.4.1

v1.4.10

v1.4.11

v1.4.12

v1.4.13

v1.4.14

v1.4.15

v1.4.2

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.4.7

v1.4.8

v1.4.9

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.6.4

v1.6.5

v1.6.6

v1.6.7

v1.6.8

v1.6.9

v1.7.0

v1.7.1

v1.7.2

v1.7.3

v1.7.4

v1.7.5

v1.7.6

v1.8.0

v1.8.1

v1.8.2-beta.1

v1.8.2-beta.2

v1.8.2-beta.3

v4.*

v4.0.0-nightly.20180816

v4.0.0-nightly.20180817

v4.0.0-nightly.20180819

v4.0.0-nightly.20180821

v4.0.0-nightly.20180823

v4.0.0-nightly.20180905

v4.0.0-nightly.20180929

v4.0.0-nightly.20181006

v4.0.0-nightly.20181010

v5.*

v5.0.0-nightly.20190107

v5.0.0-nightly.20190121

v5.0.0-nightly.20190122

v6.*

v6.0.0

v6.0.0-beta.1

v6.0.0-beta.10

v6.0.0-beta.11

v6.0.0-beta.12

v6.0.0-beta.13

v6.0.0-beta.14

v6.0.0-beta.15

v6.0.0-beta.2

v6.0.0-beta.3

v6.0.0-beta.4

v6.0.0-beta.5

v6.0.0-beta.6

v6.0.0-beta.7

v6.0.0-beta.8

v6.0.0-beta.9

v6.0.0-nightly.20190123

v6.0.0-nightly.20190212

v6.0.0-nightly.20190213

v6.0.0-nightly.20190227

v6.0.0-nightly.20190308

v6.0.0-nightly.20190311

v6.0.0-nightly.20190404

v6.0.1

v6.0.10

v6.0.11

v6.0.12

v6.0.2

v6.0.3

v6.0.4

v6.0.5

v6.0.6

v6.0.7

v6.0.8

v6.0.9

v6.1.0

v7.*

v7.0.0

v7.0.1

v7.1.0

v7.1.1

v7.1.10

v7.1.11

v7.1.12

v7.1.13

v7.1.14

v7.1.2

v7.1.3

v7.1.4

v7.1.5

v7.1.6

v7.1.7

v7.1.8

v7.1.9

v7.2.0

v7.2.1

v7.2.2

v7.2.3

v8.*

v8.0.0

v8.0.1

v8.0.2

v8.0.3

v8.1.0

v8.1.1

v8.2.0

v8.2.1

v8.2.2

v8.2.3

v9.*

v9.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15096.json"