Threats tagged 'ghsa-v64r-4m7r-3mvq'

Electron versions prior to 39.8.8 have a vulnerability where HTTP redirects followed by net.fetch() and net.request() are not restricted by scheme. This allows a remote server to redirect a request to a local resource, potentially disclosing local file contents if the app exposes the response body. Only apps making net requests to attacker-controlled URLs with redirects followed and response bodies exposed are affected. Fixed versions include 39.8.8 and later.