Threats tagged 'ghsa-5c9j-mhmv-5xgx'

Electron's shell.openPath() function did not properly reject file paths containing embedded null bytes. This allowed attackers to bypass string-only validation checks on file paths, potentially causing the application to open a different file than intended. The issue affects apps that pass untrusted input to shell.openPath() without performing filesystem-level validation. Versions prior to 39.8.6 are vulnerable. The vulnerability has been fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.