Arbitrary file read via window-open IPC in Electron

published 2020-07-07 6 y ago modified 2026-07-08 4 mo ago also GHSA-f9mq-jph6-9mhm , EUVD-2020-0553

cvss: 6.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Patch / fix

fixed in 2

npm electron 7.2.4, 8.2.4
electronjs electron 7.2.4, 8.2.4

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	6.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	electron	<7.2.4 >=8.0.0, <8.2.4	7.2.4 8.2.4

Affected products

electron electron

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties

References

electronjs.org /releases/stable?page=3#release-notes-for-v824
web, release-notes, vendor-advisory
github.com /electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-4075
advisory

Sources

CVE List CVE-2020-4075
GitHub Advisory GHSA-f9mq-jph6-9mhm
NVD CVE-2020-4075

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary