CVSS 3.1
8.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVE-2021-39184
High (8.6) in electronjs electron. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in electron 11.5.0, 12.1.0, 13.3.0.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-862, CWE-668
- Published
- Modified
- Record from
- the NVD, synced
Affected
- electronjs:electron
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mpjm-v997-c4h4 | npm | electron | <11.5.0 | 11.5.0 |
| GHSA-mpjm-v997-c4h4 | npm | electron | >=12.0.0 <12.1.0 | 12.1.0 |
| GHSA-mpjm-v997-c4h4 | npm | electron | >=13.0.0 <13.3.0 | 13.3.0 |