CVE-2024-29900

HIGH EPSS 45.8%
Published Mar 29, 20242y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Mar 29, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
45.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-402

Affected Products 1

VendorProductVersionRange
openjsfpackager18.3.0any

References 2

  • github.com https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee
    Patch
  • github.com https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57
    Vendor Advisory

Remediation

  • github.com https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee
    Patch