CVE-2024-29900
High
Description
Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductOpenjsf Packager
PublishedMar 29, 2024
First seenMar 29, 2024
Weakness typeCWE-402CWE-402
How to fix
Update
- @electron/packager18.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openjsf packager | 18.3.0 | — |
| @electron/packagernpm | 18.3.0 ≤ v < 18.3.1 | 18.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.