Threats tagged 'ghsa-4f78-qhmw-8j8m'

A vulnerability in Electron allows JavaScript injection in the DevTools frontend via an unsanitized 'mode' parameter passed to webContents.openDevTools(). This can lead to script execution in the DevTools context, which may have Node.js access in unsandboxed configurations. The issue affects applications that allow untrusted input to influence the 'mode' argument or permit untrusted content to call openDevTools on embedded webviews. Fixed versions are 39.8.7 and later.