Threats tagged 'ghsa-9qh4-3jw8-366w'

A vulnerability in Electron's <webview> tag allows Node.js integration to be enabled in Web Workers even when the embedder disables it, potentially granting guest content elevated privileges. This affects applications that enable the <webview> tag and run without sandboxing. The issue is fixed in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing nodeIntegrationInWorker from guest preferences or avoiding <webview> usage with untrusted content.