GCVE - cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*

part: a version: 9.0.0 update: -

Vendor	Electronjs (`2af93ff4-38f6-5aef-acc5-80ca92aa0b83`)
Product	Electron (`3ffe6bdf-afda-502c-ac98-8ec4a42261cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/electron/electron`	purl2cpe	2026-06-01 10:17:08.323642
`pkg:gitlab/immersaview/electron`	purl2cpe	2026-06-01 10:17:08.323643
`pkg:npm/electron`	purl2cpe	2026-06-01 10:17:08.323644
`pkg:sourceforge/electron.mirror`	purl2cpe	2026-06-01 10:17:08.323645

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-4077`	vulnerable	2026-06-08 05:25:58.829394	Context isolation bypass via contextBridge in Electron HIGH (7.7) In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. Published: 2020-07-07T00:05:16.000Z Updated: 2024-08-04T07:52:20.939Z Open on db.gcve.eu Reference links https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-4076`	vulnerable	2026-06-08 05:25:58.828250	Context isolation bypass via leaked cross-context objects in Electron HIGH (7.8) In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. Published: 2020-07-07T00:05:21.000Z Updated: 2024-08-04T07:52:20.967Z Open on db.gcve.eu Reference links https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 https://github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-4075`	vulnerable	2026-06-08 05:25:58.817074	Arbitrary file read via window-open IPC in Electron MEDIUM (6.8) In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. Published: 2020-07-07T00:05:28.000Z Updated: 2024-08-04T07:52:20.843Z Open on db.gcve.eu Reference links https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15215`	vulnerable	2026-06-08 05:19:25.494628	Context isolation bypass in Electron MEDIUM (5.6) Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Published: 2020-10-06T18:00:17.000Z Updated: 2024-08-04T13:08:22.830Z Open on db.gcve.eu Reference links https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15096`	vulnerable	2026-06-08 05:19:25.259682	Context isolation bypass via Promise in Electron MEDIUM (6.8) In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21. Published: 2020-07-07T00:10:13.000Z Updated: 2024-08-04T13:08:22.273Z Open on db.gcve.eu Reference links https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824 https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.