Threats tagged 'ghsa-jm7p-cc5g-qwxx'

On macOS, Electron's parent process code-sign check can be bypassed by a local attacker, allowing them to run code inside a signed app and inherit its TCC permissions and keychain access. This affects apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. Apps not enabling these restrictions are not affected. A patch is available and must be applied to mitigate this issue.