Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Electron: Unquoted executable path in app.setLoginItemSettings on Windows
Vulnerability Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
未经引用的搜索路径或元素
Vulnerability Title
Electron 代码问题漏洞
Vulnerability Description
Electron是Electron开源的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron 38.8.6之前版本、39.8.1之前版本、40.8.0之前版本和41.0.0-beta.8之前版本存在代码问题漏洞，该漏洞源于在Windows上app.setLoginItemSettings({openAtLogin: true})写入可执行路径时未加引号，可能导致登录时运行不同的可执行文
CVSS Information
N/A
Vulnerability Type
N/A