Threats tagged 'ghsa-vv43-5jgx-7qv8'

A local race condition vulnerability exists in the Squirrel.Mac auto-update framework bundled with Electron on macOS. The privileged ShipIt helper, which runs as root to complete updates, can be tricked by a local attacker to overwrite files of a different application instead of the intended one. This affects only Electron apps on macOS that use Squirrel.Mac-based auto-updates. No workarounds exist other than updating to a patched Electron version.