Most recent entries from all

cnvd-2016-02709

EUVD-2026-81962

fkie_cve-2016-1202

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.

GHSA-gvcj-pfq2-wxj7 — High severity vulnerability that affects electron

Affected: npm: electron

gsd-2016-1202

jvndb-2016-000054

Electron fails to restrict the path for loading Node modules, which may lead to execution of arbitrary JavaScript. Electron is a software framework for developing cross-platformm desktop applications with web technologies, such as HTML, CSS, JavaScript with Chromium and Node.js. Electron is used in applications such as Atom editor, Microsoft Visual Studio Code, etc.. Electron contains a flaw where the search path for loading Node modules is not restricted properly. This exists due to a flaw in the processing of the 'require' function. When this function is processed, all parent folders for the directory where the module exists is added to the search paths. If an attacker is able to place a malicious Node module in a resulting search path on the victim's system, this Node module will be loaded. Yosuke HASEGAWA of Secure Sky Technology Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.