In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
{
"versions": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.2.4"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.2.4"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-NA"
}
]
}[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta1"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta11"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta12"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta13"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta14"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta16"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta17"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta18"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta19"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta2"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta20"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta3"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta6"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta7"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta8"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-beta9"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4075.json"