electron-packager project vulnerabilities

Products

• electron-packager 2

Latest electron-packager project CVEs

Newest publication first

1. CVE-2024-29900 @electron/packager's build process memory potentially leaked into final executable

   Published 2024-03-29

   High·CVSS 7.5 EPSS 0.63%

   Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final e...

2. CVE-2016-10534 SSL Validation Defaults to False in electron-packager

   Published 2018-05-31

   Medium·CVSS 5.9 EPSS 0.92%

   electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This coul...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.