GHSA-hvf8-h2qh-37m9

Advisory Details

### Impact
IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:
- Uses `remote`
- Calls `webContents.sendToFrame`
- Calls `event.reply` in an IPC message handler

### Patches
This has been fixed in the following versions:

- 9.4.0
- 10.2.0
- 11.1.0
- 12.0.0-beta.9

### Workarounds
There are no workarounds for this issue.

### For more information
If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected]).

Affected Packages

npm electron

Affected versions: 0 (fixed in 9.4.0)

npm electron

Affected versions: 10.0.0 (fixed in 10.2.0)

npm electron

Affected versions: 11.0.0 (fixed in 11.1.0)

Related CVEs

CVE-2020-26272

IPC messages delivered to the wrong frame in Electron

Advisory Details

Affected Packages

Related CVEs

Key Information

Dataset