{"id":"CVE-2022-29247","published":"2022-06-13T21:05:10Z","modified":"2025-04-23T18:16:29Z","title":"Exposure of Resource to Wrong Sphere in Electron","vendor":"electron","product":"electron","tier":"tail","description":{"text":"Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.2,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01048,"percentile":0.64104,"provenance":"source"},"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7","tags":["x_refsource_CONFIRM"]}],"priority":{"score":14.4,"factors":[{"name":"EPSS percentile","points":12.82},{"name":"CVSS severity","points":1.54}]},"vendorSlug":"electron","affectedVersions":[{"vendor":"electron","product":"electron","versions":["< 15.5.5",">= 16.0.0-beta.1, < 16.2.6",">= 17.0.0-beta.1, < 17.2.0",">= 18.0.0-beta.1, <= 18.0.0-beta.5"]}],"affected":[{"ecosystem":"npm","package":"electron","vulnerableRanges":["<15.5.5",">=16.0.0, <16.2.6",">=17.0.0, <17.2.0",">=18.0.0-beta.1, <18.0.0-beta.6"],"patched":["15.5.5","16.2.6","17.2.0","18.0.0-beta.6"],"from":["GHSA-mq8j-3h7h-p8g7"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6098","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-26272","published":"2021-01-28","fixed":"11.1.0","kev":false},{"cve":"CVE-2021-39184","published":"2021-10-12","fixed":"13.3.0","kev":false},{"cve":"CVE-2022-21718","published":"2022-03-22","fixed":"17.0.0-alpha.6","kev":false},{"cve":"CVE-2022-29247","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false},{"cve":"CVE-2022-29257","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false,"link":{"from":"CVE-2022-29257","to":"CVE-2022-29247","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"15.5.0","toFixed":"15.5.5","daysApart":0},{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"16.2.0","toFixed":"16.2.6","daysApart":0}]}},{"cve":"CVE-2022-4135","published":"2022-11-25","fixed":"19.1.8","kev":true},{"cve":"CVE-2022-36077","published":"2022-11-08","fixed":"20.0.1","kev":false}],"package":"npm:electron"}}