Skip to content
OpenAdvisories
High · 7.5 CVE-2024-29900 EUVD-2024-0797GHSA-34h3-8mw4-qw57

@electron/packager's build process memory potentially leaked into final executable

Published Mar 29, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

Affected products

VendorProductAffectedFixed
electron packager = 18.3.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @electron/packager >= 18.3.0, < 18.3.1 18.3.1 GHSA-34h3-8mw4-qw57

References