mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-08 12:45:55 +08:00
chore: bump up electron version to v39.8.10 [SECURITY] (#15441)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [electron](https://redirect.github.com/electron/electron) | [`39.8.6` → `39.8.10`](https://renovatebot.com/diffs/npm/electron/39.8.6/39.8.10) |  |  | --- ### Electron: Parent process code-sign check is spoofable [CVE-2026-70597](https://nvd.nist.gov/vuln/detail/CVE-2026-70597) / [GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx) <details> <summary>More information</summary> #### Details ##### Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting `ELECTRON_RUN_AS_NODE` and `NODE_OPTIONS` to same-signed parents rely on this check; a local attacker could bypass it and run their own code inside the signed app, inheriting its TCC permissions and keychain access. Apps are only affected if they enable those macOS fuse-based restrictions. Apps that do not enable them are not affected. ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx) - [https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35](https://redirect.github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35) - [https://github.com/advisories/GHSA-jm7p-cc5g-qwxx](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-jm7p-cc5g-qwxx) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size [CVE-2026-70598](https://nvd.nist.gov/vuln/detail/CVE-2026-70598) / [GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp) <details> <summary>More information</summary> #### Details ##### Impact In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected. ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.10` ##### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 3.9 / 10 (Low) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L` #### References - [https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp) - [https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb](https://redirect.github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb) - [https://github.com/advisories/GHSA-pfmc-3mgc-p6fp](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pfmc-3mgc-p6fp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin [CVE-2026-70599](https://nvd.nist.gov/vuln/detail/CVE-2026-70599) / [GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp) <details> <summary>More information</summary> #### Details ##### Impact For serial-port and media (camera / microphone) permission checks made from an iframe, the `requestingOrigin` passed to `session.setPermissionCheckHandler` was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin. Apps are only affected if they use `setPermissionCheckHandler` with origin-based logic and embed cross-origin iframes with delegated device permissions. Apps that base the decision on `details.securityOrigin`, or that do not embed such iframes, are not affected. ##### Workarounds Check `details.securityOrigin` instead of `requestingOrigin` for these permissions, or do not delegate device permissions to untrusted iframes. ##### Fixed Versions * `42.0.0-beta.1` * `41.2.0` * `40.9.0` * `39.8.7` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp) - [https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c](https://redirect.github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c) - [https://github.com/advisories/GHSA-9pf5-hg6p-4pwp](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-9pf5-hg6p-4pwp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Cross-origin iframe can position native autofill popup [CVE-2026-70600](https://nvd.nist.gov/vuln/detail/CVE-2026-70600) / [GHSA-x8rc-wpg4-grpf](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf) <details> <summary>More information</summary> #### Details ##### Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. ##### Workarounds Do not embed untrusted content in iframes inside windows that display trusted UI. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 3.1 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf](https://redirect.github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf) - [https://github.com/advisories/GHSA-x8rc-wpg4-grpf](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-x8rc-wpg4-grpf) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Context isolation bypass via Function.prototype.bind hijack [CVE-2026-70601](https://nvd.nist.gov/vuln/detail/CVE-2026-70601) / [GHSA-h7rp-cf8h-j98x](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x) <details> <summary>More information</summary> #### Details ##### Impact Apps that expose Promise-returning functions to web content via `contextBridge` may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with `nodeIntegration` enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via `contextBridge` — the standard pattern for wrapping `ipcRenderer.invoke` — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected. ##### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ##### Fixed Versions * `42.0.0-beta.5` * `41.2.2` * `40.9.2` * `39.8.9` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x](https://redirect.github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x) - [https://github.com/advisories/GHSA-h7rp-cf8h-j98x](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-h7rp-cf8h-j98x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Extension tab APIs operate across session boundaries [CVE-2026-70602](https://nvd.nist.gov/vuln/detail/CVE-2026-70602) / [GHSA-m55f-7gqj-fr98](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98) <details> <summary>More information</summary> #### Details ##### Impact Extension tab and scripting APIs were not scoped to the extension's own `session`. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via `session.loadExtension` and rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected. ##### Workarounds Only load extensions from sources you trust; do not rely on session separation alone to contain an extension. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 6.6 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98](https://redirect.github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98) - [https://github.com/advisories/GHSA-m55f-7gqj-fr98](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-m55f-7gqj-fr98) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads [CVE-2026-70604](https://nvd.nist.gov/vuln/detail/CVE-2026-70604) / [GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw) <details> <summary>More information</summary> #### Details ##### Impact A custom scheme registered with `supportFetchAPI: true` but without `corsEnabled: true` was not subject to CORS enforcement. A page loaded from a remote origin could therefore `fetch()` or `XMLHttpRequest` that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set `corsEnabled: true`, or that do not load untrusted content, are not affected. ##### Workarounds Set `corsEnabled: true` on schemes that must enforce CORS, and validate the request `Origin` in your protocol handler before returning sensitive data. ##### Fixed Versions * `42.0.0` * `41.4.0` * `40.9.3` * `39.8.10` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 7.4 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw) - [https://github.com/advisories/GHSA-v3j7-r9gq-3gjw](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v3j7-r9gq-3gjw) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: HTTP redirect followed into local file loader [CVE-2026-70605](https://nvd.nist.gov/vuln/detail/CVE-2026-70605) / [GHSA-v64r-4m7r-3mvq](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq) <details> <summary>More information</summary> #### Details ##### Impact When following HTTP redirects, `net.fetch()` and `net.request()` did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make `net` requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected. ##### Workarounds Set `redirect: 'error'` or `redirect: 'manual'` on requests to untrusted URLs and validate any redirect target before following it. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq](https://redirect.github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq) - [https://github.com/advisories/GHSA-v64r-4m7r-3mvq](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v64r-4m7r-3mvq) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: window.open features string controls some window options considered privileged [CVE-2026-70607](https://nvd.nist.gov/vuln/detail/CVE-2026-70607) / [GHSA-v93f-fgjr-hjrj](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj) <details> <summary>More information</summary> #### Details ##### Impact Some window options supplied by web content in the `window.open()` features string were applied to the new `BrowserWindow` without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths. Apps are only affected if untrusted content can call `window.open()` and the app does not override child window options via `setWindowOpenHandler`. Apps that deny `window.open()` for untrusted content, or set `overrideBrowserWindowOptions` explicitly, are not affected. ##### Workarounds Return `{ action: 'deny' }` from `setWindowOpenHandler` for untrusted content, or supply `overrideBrowserWindowOptions` so every window option is set explicitly. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj](https://redirect.github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj) - [https://github.com/electron/electron/pull/50946](https://redirect.github.com/electron/electron/pull/50946) - [https://github.com/electron/electron/pull/50947](https://redirect.github.com/electron/electron/pull/50947) - [https://github.com/electron/electron/pull/50948](https://redirect.github.com/electron/electron/pull/50948) - [https://github.com/electron/electron/pull/50949](https://redirect.github.com/electron/electron/pull/50949) - [https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://redirect.github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a) - [https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7](https://redirect.github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7) - [https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b](https://redirect.github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b) - [https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55](https://redirect.github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55) - [https://github.com/electron/electron/releases/tag/v39.8.8](https://redirect.github.com/electron/electron/releases/tag/v39.8.8) - [https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0) - [https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1) - [https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3) - [https://github.com/advisories/GHSA-v93f-fgjr-hjrj](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v93f-fgjr-hjrj) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter [CVE-2026-70609](https://nvd.nist.gov/vuln/detail/CVE-2026-70609) / [GHSA-4f78-qhmw-8j8m](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m) <details> <summary>More information</summary> #### Details ##### Impact The `mode` option of `webContents.openDevTools()` was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if untrusted input can reach the `mode` argument of `openDevTools()`, or if untrusted content can call `openDevTools()` on a `<webview>` it embeds. Apps that only ever pass a fixed dock mode are not affected. ##### Workarounds Only pass fixed, allowlisted values (`right`, `bottom`, `undocked`, `detach`) as the DevTools `mode`, and do not expose `openDevTools` to untrusted content. ##### Fixed Versions * `42.0.0-beta.1` * `41.2.0` * `40.9.0` * `39.8.7` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m](https://redirect.github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m) - [https://github.com/electron/electron/pull/50665](https://redirect.github.com/electron/electron/pull/50665) - [https://github.com/electron/electron/pull/50666](https://redirect.github.com/electron/electron/pull/50666) - [https://github.com/electron/electron/pull/50667](https://redirect.github.com/electron/electron/pull/50667) - [https://github.com/electron/electron/pull/50668](https://redirect.github.com/electron/electron/pull/50668) - [https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1](https://redirect.github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1) - [https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b](https://redirect.github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b) - [https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce](https://redirect.github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce) - [https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba](https://redirect.github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba) - [https://github.com/electron/electron/releases/tag/v39.8.7](https://redirect.github.com/electron/electron/releases/tag/v39.8.7) - [https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0) - [https://github.com/electron/electron/releases/tag/v41.2.0](https://redirect.github.com/electron/electron/releases/tag/v41.2.0) - [https://github.com/electron/electron/releases/tag/v42.0.0-beta.1](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.1) - [https://github.com/advisories/GHSA-4f78-qhmw-8j8m](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4f78-qhmw-8j8m) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path [CVE-2026-70608](https://nvd.nist.gov/vuln/detail/CVE-2026-70608) / [GHSA-9f4c-93c8-jc8g](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g) <details> <summary>More information</summary> #### Details ##### Impact A sandboxed iframe without the `allow-popups` keyword could still open a new window (or trigger `setWindowOpenHandler`) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of `allow-popups` to prevent window creation are affected. Apps that deny window creation in `setWindowOpenHandler`, or that do not embed untrusted content in sandboxed iframes, are not affected. ##### Workarounds Return `{ action: 'deny' }` from `setWindowOpenHandler` for any content you do not trust, rather than relying on the iframe sandbox alone. ##### Fixed Versions * `42.0.1` * `41.10.3` * `39.8.10` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 7.2 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g](https://redirect.github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g) - [https://github.com/electron/electron/pull/51437](https://redirect.github.com/electron/electron/pull/51437) - [https://github.com/electron/electron/pull/51438](https://redirect.github.com/electron/electron/pull/51438) - [https://github.com/electron/electron/pull/51439](https://redirect.github.com/electron/electron/pull/51439) - [https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57](https://redirect.github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57) - [https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3](https://redirect.github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3) - [https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f](https://redirect.github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f) - [https://github.com/electron/electron/releases/tag/v39.8.10](https://redirect.github.com/electron/electron/releases/tag/v39.8.10) - [https://github.com/electron/electron/releases/tag/v41.10.3](https://redirect.github.com/electron/electron/releases/tag/v41.10.3) - [https://github.com/electron/electron/releases/tag/v42.0.1](https://redirect.github.com/electron/electron/releases/tag/v42.0.1) - [https://github.com/advisories/GHSA-9f4c-93c8-jc8g](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-9f4c-93c8-jc8g) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: contextBridge object copy honors prototype setters [CVE-2026-70610](https://nvd.nist.gov/vuln/detail/CVE-2026-70610) / [GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4) <details> <summary>More information</summary> #### Details ##### Impact Objects copied across the `contextBridge` boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks. Apps that only accept primitive arguments, or that validate object arguments, are not affected. ##### Workarounds Validate objects received from untrusted content with own-property checks (`Object.hasOwn`), or copy them onto a null-prototype object before use. ##### Fixed Versions * `42.0.0-beta.4` * `41.2.2` * `40.9.2` * `39.8.9` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4) - [https://github.com/electron/electron/pull/51083](https://redirect.github.com/electron/electron/pull/51083) - [https://github.com/electron/electron/pull/51084](https://redirect.github.com/electron/electron/pull/51084) - [https://github.com/electron/electron/pull/51085](https://redirect.github.com/electron/electron/pull/51085) - [https://github.com/electron/electron/pull/51086](https://redirect.github.com/electron/electron/pull/51086) - [https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713](https://redirect.github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713) - [https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd](https://redirect.github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd) - [https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55](https://redirect.github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55) - [https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737](https://redirect.github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737) - [https://github.com/electron/electron/releases/tag/v39.8.9](https://redirect.github.com/electron/electron/releases/tag/v39.8.9) - [https://github.com/electron/electron/releases/tag/v40.9.2](https://redirect.github.com/electron/electron/releases/tag/v40.9.2) - [https://github.com/electron/electron/releases/tag/v41.2.2](https://redirect.github.com/electron/electron/releases/tag/v41.2.2) - [https://github.com/electron/electron/releases/tag/v42.0.0-beta.4](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.4) - [https://github.com/advisories/GHSA-ff2p-hmqr-hxm4](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-ff2p-hmqr-hxm4) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: DevTools embedder handler executes arbitrary files via shell open [CVE-2026-70611](https://nvd.nist.gov/vuln/detail/CVE-2026-70611) / [GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp) <details> <summary>More information</summary> #### Details ##### Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend (such as a malicious DevTools extension) could use this to execute native code outside the sandbox. Apps are only affected if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. Apps that do not open DevTools in that context are not affected. ##### Workarounds Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.2` * `39.8.9` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp) - [https://github.com/electron/electron/pull/50937](https://redirect.github.com/electron/electron/pull/50937) - [https://github.com/electron/electron/pull/50938](https://redirect.github.com/electron/electron/pull/50938) - [https://github.com/electron/electron/pull/51114](https://redirect.github.com/electron/electron/pull/51114) - [https://github.com/electron/electron/pull/51115](https://redirect.github.com/electron/electron/pull/51115) - [https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322](https://redirect.github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322) - [https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44](https://redirect.github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44) - [https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de](https://redirect.github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de) - [https://github.com/electron/electron/releases/tag/v39.8.9](https://redirect.github.com/electron/electron/releases/tag/v39.8.9) - [https://github.com/electron/electron/releases/tag/v40.9.2](https://redirect.github.com/electron/electron/releases/tag/v40.9.2) - [https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1) - [https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3) - [https://github.com/advisories/GHSA-f2r8-jv7c-xqmp](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-f2r8-jv7c-xqmp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Electron: Sandboxed iframes can launch external protocol handlers [CVE-2026-70612](https://nvd.nist.gov/vuln/detail/CVE-2026-70612) / [GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp) <details> <summary>More information</summary> #### Details ##### Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Apps are only affected if they render untrusted content in sandboxed iframes and grant the `openExternal` permission (granted by default when no `setPermissionRequestHandler` is installed). Apps whose permission handler denies `openExternal` for untrusted content are not affected. ##### Workarounds Install a `setPermissionRequestHandler` that denies the `openExternal` permission for untrusted content. ##### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ##### For more information If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org) #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N` #### References - [https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp) - [https://github.com/electron/electron/pull/50961](https://redirect.github.com/electron/electron/pull/50961) - [https://github.com/electron/electron/pull/50962](https://redirect.github.com/electron/electron/pull/50962) - [https://github.com/electron/electron/pull/50963](https://redirect.github.com/electron/electron/pull/50963) - [https://github.com/electron/electron/pull/50964](https://redirect.github.com/electron/electron/pull/50964) - [https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5](https://redirect.github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5) - [https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a](https://redirect.github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a) - [https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39](https://redirect.github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39) - [https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3](https://redirect.github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3) - [https://github.com/electron/electron/releases/tag/v39.8.8](https://redirect.github.com/electron/electron/releases/tag/v39.8.8) - [https://github.com/electron/electron/releases/tag/v40.9.0](https://redirect.github.com/electron/electron/releases/tag/v40.9.0) - [https://github.com/electron/electron/releases/tag/v41.2.1](https://redirect.github.com/electron/electron/releases/tag/v41.2.1) - [https://github.com/electron/electron/releases/tag/v42.0.0-beta.3](https://redirect.github.com/electron/electron/releases/tag/v42.0.0-beta.3) - [https://github.com/advisories/GHSA-p2rr-rvmm-c5fp](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-p2rr-rvmm-c5fp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>electron/electron (electron)</summary> ### [`v39.8.10`](https://redirect.github.com/electron/electron/releases/tag/v39.8.10): electron v39.8.10 [Compare Source](https://redirect.github.com/electron/electron/compare/v39.8.9...v39.8.10) ### Release Notes for v39.8.10 > \[!WARNING] > Electron 39.x.y has reached end-of-support as per the project's [support policy](https://www.electronjs.org/docs/latest/tutorial/electron-timelines#version-support-policy). Developers and applications are encouraged to upgrade to a newer version of Electron. #### Fixes - Ensured cross-origin `fetch()` and XHR are blocked for custom protocols registered with `supportFetchAPI: true` unless `corsEnabled: true` is also set; cross-origin `mode: 'no-cors'` requests now receive an opaque response. [#​51272](https://redirect.github.com/electron/electron/pull/51272) <sup>(Also in [40](https://redirect.github.com/electron/electron/pull/51271), [41](https://redirect.github.com/electron/electron/pull/51270), [42](https://redirect.github.com/electron/electron/pull/51269))</sup> - Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. [#​50766](https://redirect.github.com/electron/electron/pull/50766) <sup>(Also in [42](https://redirect.github.com/electron/electron/pull/50765))</sup> #### Other Changes - Backported a fix for route\_id validation in the GPU command buffer. [#​51327](https://redirect.github.com/electron/electron/pull/51327) - Backported security fixes for [`4933194`](https://redirect.github.com/electron/electron/commit/493319454), [`4941583`](https://redirect.github.com/electron/electron/commit/494158331), [`4932347`](https://redirect.github.com/electron/electron/commit/493234757), [`4927361`](https://redirect.github.com/electron/electron/commit/492736100), [`4934134`](https://redirect.github.com/electron/electron/commit/493413432), [`4926688`](https://redirect.github.com/electron/electron/commit/492668885), [`4962818`](https://redirect.github.com/electron/electron/commit/496281816). [#​51257](https://redirect.github.com/electron/electron/pull/51257) - Backported several fixes in Skia, ANGLE, and WebRTC from upstream. [#​51266](https://redirect.github.com/electron/electron/pull/51266) ### [`v39.8.9`](https://redirect.github.com/electron/electron/releases/tag/v39.8.9): electron v39.8.9 [Compare Source](https://redirect.github.com/electron/electron/compare/v39.8.8...v39.8.9) ### Release Notes for v39.8.9 #### Other Changes - Fixed `gn gen` failing to resolve `electron_version` when building from a `git worktree` checkout. [#​51163](https://redirect.github.com/electron/electron/pull/51163) <sup>(Also in [40](https://redirect.github.com/electron/electron/pull/51164), [41](https://redirect.github.com/electron/electron/pull/51165), [42](https://redirect.github.com/electron/electron/pull/51166))</sup> - Security: backported fixes for CVE-2026-6296, CVE-2026-6297, CVE-2026-6298, CVE-2026-6299, CVE-2026-6300, CVE-2026-6301, CVE-2026-6302, CVE-2026-6303, CVE-2026-6304, CVE-2026-6305, CVE-2026-6306, CVE-2026-6307, CVE-2026-6308, CVE-2026-6309, CVE-2026-6311, CVE-2026-6312, CVE-2026-6313, CVE-2026-6314, CVE-2026-6316, CVE-2026-6318, CVE-2026-6358, CVE-2026-6359, CVE-2026-6360, CVE-2026-6361, CVE-2026-6362, CVE-2026-6363, CVE-2026-6364. [#​51141](https://redirect.github.com/electron/electron/pull/51141) ### [`v39.8.8`](https://redirect.github.com/electron/electron/releases/tag/v39.8.8): electron v39.8.8 [Compare Source](https://redirect.github.com/electron/electron/compare/v39.8.7...v39.8.8) ### Release Notes for v39.8.8 #### Fixes - Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. [#​50818](https://redirect.github.com/electron/electron/pull/50818) <sup>(Also in [40](https://redirect.github.com/electron/electron/pull/50817), [41](https://redirect.github.com/electron/electron/pull/50816), [42](https://redirect.github.com/electron/electron/pull/50815))</sup> #### Other Changes - Backported fix for [chromium:74266014](https://issues.chromium.org/issues/474266014). [#​50175](https://redirect.github.com/electron/electron/pull/50175) - Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. [#​50993](https://redirect.github.com/electron/electron/pull/50993) ### [`v39.8.7`](https://redirect.github.com/electron/electron/releases/tag/v39.8.7): electron v39.8.7 [Compare Source](https://redirect.github.com/electron/electron/compare/v39.8.6...v39.8.7) ### Release Notes for v39.8.7 #### Other Changes - Backported fix for [`4897116`](https://redirect.github.com/electron/electron/commit/489711638). [#​50624](https://redirect.github.com/electron/electron/pull/50624) - Backported fix for [`4939526`](https://redirect.github.com/electron/electron/commit/493952652). [#​50620](https://redirect.github.com/electron/electron/pull/50620) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This commit is contained in:
renovate[bot]
@@ -22344,15 +22344,15 @@ __metadata:
|
||||
linkType: hard
|
||||
|
||||
"electron@npm:^39.0.0":
|
||||
version: 39.8.6
|
||||
resolution: "electron@npm:39.8.6"
|
||||
version: 39.8.10
|
||||
resolution: "electron@npm:39.8.10"
|
||||
dependencies:
|
||||
"@electron/get": "npm:^2.0.0"
|
||||
"@types/node": "npm:^22.7.7"
|
||||
extract-zip: "npm:^2.0.1"
|
||||
bin:
|
||||
electron: cli.js
|
||||
checksum: 10/52f1aa1362831ec5410a39bde2a7db548d07047bec04bc70c0c3bbba81d53c21074c46db9ff12638587d793ba841713a28b009afadadbe0492e3bd9bc448948d
|
||||
checksum: 10/d85c8a86d6213885a8b0f22e8d18ad28147913510d0c89838567e9f7a244538945c292724ede3e5110b49a7ae71430600e181709cdbc37decdb4a0197d5394aa
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user