GHSA-v64r-4m7r-3mvq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v64r-4m7r-3mvq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v64r-4m7r-3mvq/GHSA-v64r-4m7r-3mvq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v64r-4m7r-3mvq
- Aliases
- Published
- 2026-08-05T16:04:09Z
- Modified
- 2026-08-05T16:26:04Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Electron: HTTP redirect followed into local file loader
- Details
-
Impact
When following HTTP redirects,
net.fetch()andnet.request()did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.Apps are only affected if they make
netrequests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.Workarounds
Set
redirect: 'error'orredirect: 'manual'on requests to untrusted URLs and validate any redirect target before following it.Fixed Versions
42.0.0-beta.341.2.140.9.039.8.8
For more information
If you have any questions or comments about this advisory, email Electron at security@electronjs.org
- Database specific
{ "cwe_ids": [ "CWE-918" ], "github_reviewed": true, "github_reviewed_at": "2026-08-05T16:04:09Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron
npm / electron
Package
- Name
- electron
- View open source insights on deps.dev
- Purl
- pkg:npm/electron