Threats tagged 'ghsa-v93f-fgjr-hjrj'

A vulnerability in Electron allows untrusted web content to control certain privileged window options via the window.open() features string. This can lead to the main process accessing attacker-chosen file or network paths if the app does not restrict or override these options. The issue affects Electron versions before 39.8.8 and is mitigated by denying window.open() calls from untrusted content or explicitly overriding window options. Fixed versions include 39.8.8 and later.