AIKIDO-2024-10094
electron is vulnerable to Improper Privilege Management
70
High Risk
This Affects:
electronTL;DR
setuid() does not affect libuv's internal io_uring operations if it is initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through the setuid() call.
Who does this affect?
You are affected if you are using a electron version which is within vulnerability ranges and a version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Background info
electron is vulnerable to Improper Privilege Management in versions 29.0.0 - 29.3.3.
How to fix this
Upgrade the electron library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant