cveboard RSS feed

CVE-2023-44402

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2023
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

ASAR Integrity bypass via filetype confusion in electron

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

electron

Vendor
electron
Product
electron
Platforms
Unknown
Default status
Unknown
electron · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 22.3.24affectedUnavailableUnavailableUnavailableNone listed
>= 23.0.0-alpha.1, <= 23.3.13affectedUnavailableUnavailableUnavailableNone listed
>= 24.0.0-alpha.1, < 24.8.3affectedUnavailableUnavailableUnavailableNone listed
>= 25.0.0-alpha.1, < 25.8.1affectedUnavailableUnavailableUnavailableNone listed
>= 26.0.0-alpha.1, < 26.2.1affectedUnavailableUnavailableUnavailableNone listed
>= 27.0.0-alpha.1, < 27.0.0-alpha.7affectedUnavailableUnavailableUnavailableNone listed