CVE-2020-26272
- Source
- https://cve.org/CVERecord?id=CVE-2020-26272
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26272.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-26272
- Aliases
- Published
- 2021-01-28T19:15:13Z
- Modified
- 2026-10-16T02:49:31Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:electronjs:electron:10.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta19:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta20:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta21:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta23:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta24:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta25:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:10.0.0:beta9:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta16:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta18:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta19:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta20:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta21:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta22:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta23:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:11.0.0:beta9:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:12.0.0:beta9:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta21:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta22:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta23:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta24:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.0.0-beta1" }, { "last_affected": "9.0.0-beta1" }, { "introduced": "9.0.0-beta10" }, { "last_affected": "9.0.0-beta10" }, { "introduced": "9.0.0-beta11" }, { "last_affected": "9.0.0-beta11" }, { "introduced": "9.0.0-beta12" }, { "last_affected": "9.0.0-beta12" }, { "introduced": "9.0.0-beta13" }, { "last_affected": "9.0.0-beta13" }, { "introduced": "9.0.0-beta14" }, { "last_affected": "9.0.0-beta14" }, { "introduced": "9.0.0-beta15" }, { "last_affected": "9.0.0-beta15" }, { "introduced": "9.0.0-beta16" }, { "last_affected": "9.0.0-beta16" }, { "introduced": "9.0.0-beta17" }, { "last_affected": "9.0.0-beta17" }, { "introduced": "9.0.0-beta18" }, { "last_affected": "9.0.0-beta18" }, { "introduced": "9.0.0-beta19" }, { "last_affected": "9.0.0-beta19" }, { "introduced": "9.0.0-beta2" }, { "last_affected": "9.0.0-beta2" }, { "introduced": "9.0.0-beta20" }, { "last_affected": "9.0.0-beta20" }, { "introduced": "9.0.0-beta21" }, { "last_affected": "9.0.0-beta21" }, { "introduced": "9.0.0-beta22" }, { "last_affected": "9.0.0-beta22" }, { "introduced": "9.0.0-beta23" }, { "last_affected": "9.0.0-beta23" }, { "introduced": "9.0.0-beta24" }, { "last_affected": "9.0.0-beta24" }, { "introduced": "9.0.0-beta3" }, { "last_affected": "9.0.0-beta3" }, { "introduced": "9.0.0-beta4" }, { "last_affected": "9.0.0-beta4" }, { "introduced": "9.0.0-beta5" }, { "last_affected": "9.0.0-beta5" }, { "introduced": "9.0.0-beta6" }, { "last_affected": "9.0.0-beta6" }, { "introduced": "9.0.0-beta7" }, { "last_affected": "9.0.0-beta7" }, { "introduced": "9.0.0-beta8" }, { "last_affected": "9.0.0-beta8" }, { "introduced": "9.0.0-beta9" }, { "last_affected": "9.0.0-beta9" }, { "introduced": "10.0.0-beta1" }, { "last_affected": "10.0.0-beta1" }, { "introduced": "10.0.0-beta10" }, { "last_affected": "10.0.0-beta10" }, { "introduced": "10.0.0-beta11" }, { "last_affected": "10.0.0-beta11" }, { "introduced": "10.0.0-beta12" }, { "last_affected": "10.0.0-beta12" }, { "introduced": "10.0.0-beta13" }, { "last_affected": "10.0.0-beta13" }, { "introduced": "10.0.0-beta14" }, { "last_affected": "10.0.0-beta14" }, { "introduced": "10.0.0-beta15" }, { "last_affected": "10.0.0-beta15" }, { "introduced": "10.0.0-beta17" }, { "last_affected": "10.0.0-beta17" }, { "introduced": "10.0.0-beta19" }, { "last_affected": "10.0.0-beta19" }, { "introduced": "10.0.0-beta2" }, { "last_affected": "10.0.0-beta2" }, { "introduced": "10.0.0-beta20" }, { "last_affected": "10.0.0-beta20" }, { "introduced": "10.0.0-beta21" }, { "last_affected": "10.0.0-beta21" }, { "introduced": "10.0.0-beta23" }, { "last_affected": "10.0.0-beta23" }, { "introduced": "10.0.0-beta24" }, { "last_affected": "10.0.0-beta24" }, { "introduced": "10.0.0-beta25" }, { "last_affected": "10.0.0-beta25" }, { "introduced": "10.0.0-beta3" }, { "last_affected": "10.0.0-beta3" }, { "introduced": "10.0.0-beta4" }, { "last_affected": "10.0.0-beta4" }, { "introduced": "10.0.0-beta5" }, { "last_affected": "10.0.0-beta5" }, { "introduced": "10.0.0-beta6" }, { "last_affected": "10.0.0-beta6" }, { "introduced": "10.0.0-beta7" }, { "last_affected": "10.0.0-beta7" }, { "introduced": "10.0.0-beta8" }, { "last_affected": "10.0.0-beta8" }, { "introduced": "10.0.0-beta9" }, { "last_affected": "10.0.0-beta9" }, { "introduced": "11.0.0-beta1" }, { "last_affected": "11.0.0-beta1" }, { "introduced": "11.0.0-beta10" }, { "last_affected": "11.0.0-beta10" }, { "introduced": "11.0.0-beta11" }, { "last_affected": "11.0.0-beta11" }, { "introduced": "11.0.0-beta12" }, { "last_affected": "11.0.0-beta12" }, { "introduced": "11.0.0-beta13" }, { "last_affected": "11.0.0-beta13" }, { "introduced": "11.0.0-beta14" }, { "last_affected": "11.0.0-beta14" }, { "introduced": "11.0.0-beta15" }, { "last_affected": "11.0.0-beta15" }, { "introduced": "11.0.0-beta16" }, { "last_affected": "11.0.0-beta16" }, { "introduced": "11.0.0-beta17" }, { "last_affected": "11.0.0-beta17" }, { "introduced": "11.0.0-beta18" }, { "last_affected": "11.0.0-beta18" }, { "introduced": "11.0.0-beta19" }, { "last_affected": "11.0.0-beta19" }, { "introduced": "11.0.0-beta20" }, { "last_affected": "11.0.0-beta20" }, { "introduced": "11.0.0-beta21" }, { "last_affected": "11.0.0-beta21" }, { "introduced": "11.0.0-beta22" }, { "last_affected": "11.0.0-beta22" }, { "introduced": "11.0.0-beta23" }, { "last_affected": "11.0.0-beta23" }, { "introduced": "11.0.0-beta3" }, { "last_affected": "11.0.0-beta3" }, { "introduced": "11.0.0-beta4" }, { "last_affected": "11.0.0-beta4" }, { "introduced": "11.0.0-beta5" }, { "last_affected": "11.0.0-beta5" }, { "introduced": "11.0.0-beta6" }, { "last_affected": "11.0.0-beta6" }, { "introduced": "11.0.0-beta7" }, { "last_affected": "11.0.0-beta7" }, { "introduced": "11.0.0-beta8" }, { "last_affected": "11.0.0-beta8" }, { "introduced": "11.0.0-beta9" }, { "last_affected": "11.0.0-beta9" }, { "introduced": "12.0.0-beta1" }, { "last_affected": "12.0.0-beta1" }, { "introduced": "12.0.0-beta3" }, { "last_affected": "12.0.0-beta3" }, { "introduced": "12.0.0-beta4" }, { "last_affected": "12.0.0-beta4" }, { "introduced": "12.0.0-beta5" }, { "last_affected": "12.0.0-beta5" }, { "introduced": "12.0.0-beta6" }, { "last_affected": "12.0.0-beta6" }, { "introduced": "12.0.0-beta7" }, { "last_affected": "12.0.0-beta7" }, { "introduced": "12.0.0-beta8" }, { "last_affected": "12.0.0-beta8" }, { "introduced": "12.0.0-beta9" }, { "last_affected": "12.0.0-beta9" } ], "source": "CPE_STRING" } ], "vendor_product": "electronjs:electron" } ] }- References
-
- https://github.com/electron/electron/pull/26875
- https://github.com/electron/electron/releases/tag/v9.4.0
- https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9
- https://www.electronjs.org/releases/stable?version=9#9.4.0
- https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c
- https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208
- https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2
- https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc
- https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd
Affected packages
Git / github.com/electron/electron
Affected ranges
- Type
- GIT
- Repo
- https://github.com/electron/electron
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0" }, { "fixed": "9.4.0" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.0.0" }, { "fixed": "10.2.0" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0" }, { "fixed": "11.1.0" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "07a1c2a3e5845901f7e2eda9506695be58edc73c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "0bbd268eb4caf35604443df5ff196980dd49e208" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "36c695ce2a7e22c07fe1e30c61c00d20371daee2" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "429400040ecb16a21d19936658579e65a797e4cc" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v9.4.0", "range": [ { "fixed": "f37c1ff6443f2ef6cd946886c735533bf6260c19" } ], "source": "REFERENCES_TAG" } ] }