Vulnerability-Lookup

CVE-2025-55305 (GCVE-0-2025-55305)

Vulnerability from cvelistv5 – Published: 2025-09-04 23:05 – Updated: 2025-09-05 15:44

Title

Electron is vulnerable to Code Injection via resource modification

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-05 15:44 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7613 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/electron/electron/security/adv…	x_refsource_CONFIRM
https://github.com/electron/electron/pull/48101	x_refsource_MISC
https://github.com/electron/electron/pull/48102	x_refsource_MISC
https://github.com/electron/electron/pull/48103	x_refsource_MISC
https://github.com/electron/electron/pull/48104	x_refsource_MISC
https://github.com/electron/electron/commit/23a02…	x_refsource_MISC
https://github.com/electron/electron/commit/2e5a0…	x_refsource_MISC
https://github.com/electron/electron/commit/3f925…	x_refsource_MISC
https://github.com/electron/electron/commit/fdf29…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
electron	electron	Affected: < 35.7.5 Affected: >= 36.0.0-alpha.1, < 36.8.1 Affected: >= 37.0.0-alpha.1, < 37.3.1 Affected: >= 38.0.0-alpha.1, < 38.0.0-beta.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55305",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T15:44:19.972893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-05T15:44:54.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 35.7.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 36.0.0-alpha.1, \u003c 36.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0-alpha.1, \u003c 37.3.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 38.0.0-alpha.1, \u003c 38.0.0-beta.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-04T23:05:07.274Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"
        },
        {
          "name": "https://github.com/electron/electron/pull/48101",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/48101"
        },
        {
          "name": "https://github.com/electron/electron/pull/48102",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/48102"
        },
        {
          "name": "https://github.com/electron/electron/pull/48103",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/48103"
        },
        {
          "name": "https://github.com/electron/electron/pull/48104",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/48104"
        },
        {
          "name": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"
        },
        {
          "name": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"
        },
        {
          "name": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"
        },
        {
          "name": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"
        }
      ],
      "source": {
        "advisory": "GHSA-vmqv-hx8q-j7mg",
        "discovery": "UNKNOWN"
      },
      "title": "Electron is vulnerable to Code Injection via resource modification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55305",
    "datePublished": "2025-09-04T23:05:07.274Z",
    "dateReserved": "2025-08-12T16:15:30.239Z",
    "dateUpdated": "2025-09-05T15:44:54.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-55305",
      "date": "2026-10-19",
      "epss": "0.00276",
      "percentile": "0.18844"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "electron",
                "vendor": "electron",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 35.7.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 36.0.0-alpha.1, \u003c 36.8.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 37.0.0-alpha.1, \u003c 37.3.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 38.0.0-alpha.1, \u003c 38.0.0-beta.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6."
          },
          {
            "lang": "es",
            "value": "Electron es un framework para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. En versiones anteriores a 35.7.5, 36.0.0-alpha.1 hasta 36.8.0, 37.0.0-alpha.1 hasta 37.3.1 y 38.0.0-alpha.1 hasta 38.0.0-beta.6, Omisi\u00f3n de la Integridad de ASAR mediante modificaci\u00f3n de recursos. Esto solo afecta a las aplicaciones que tienen las fusibles embeddedAsarIntegrityValidation y onlyLoadAppFromAsar habilitados. Las aplicaciones sin estos fusibles habilitados no se ven afectadas. Este problema est\u00e1 solucionado en las versiones 35.7.5, 36.8.1, 37.3.1 y 38.0.0-beta.6."
          }
        ],
        "id": "CVE-2025-55305",
        "lastModified": "2026-10-19T17:10:00.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-55305",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T15:44:19.972893Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-04T23:15:33.520",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/pull/48101"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/pull/48102"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/pull/48103"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/pull/48104"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              },
              {
                "lang": "en",
                "value": "CWE-829"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-06T20:16:58+00:00",
      "cve": "CVE-2025-55305",
      "id": "CVE-2025-55305",
      "initial_release_date": "2025-09-04T23:05:07.274000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "electron: ASAR Integrity Bypass via resource modification",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55305.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-55305",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-05T15:44:19.972893Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-05T15:44:49.863Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "electron",
              "vendor": "electron",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 35.7.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 36.0.0-alpha.1, \u003c 36.8.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 37.0.0-alpha.1, \u003c 37.3.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 38.0.0-alpha.1, \u003c 38.0.0-beta.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-829",
                  "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-04T23:05:07.274Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"
            },
            {
              "name": "https://github.com/electron/electron/pull/48101",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/pull/48101"
            },
            {
              "name": "https://github.com/electron/electron/pull/48102",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/pull/48102"
            },
            {
              "name": "https://github.com/electron/electron/pull/48103",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/pull/48103"
            },
            {
              "name": "https://github.com/electron/electron/pull/48104",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/pull/48104"
            },
            {
              "name": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"
            },
            {
              "name": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"
            },
            {
              "name": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"
            },
            {
              "name": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"
            }
          ],
          "source": {
            "advisory": "GHSA-vmqv-hx8q-j7mg",
            "discovery": "UNKNOWN"
          },
          "title": "Electron is vulnerable to Code Injection via resource modification"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-55305",
        "datePublished": "2025-09-04T23:05:07.274Z",
        "dateReserved": "2025-08-12T16:15:30.239Z",
        "dateUpdated": "2025-09-05T15:44:54.628Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-12971 (CVE-2025-55305)

Vulnerability from fstec – Published: 2025-10-15 – Updated: 2025-10-15 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость функций embeddedAsarIntegrityValidation() и onlyLoadAppFromAsar() программной платформы для создания приложений Electron, позволяющая нарушителю получить несанкционированный доступ на чтение и изменение данных

Summary

Уязвимость функций embeddedAsarIntegrityValidation() и onlyLoadAppFromAsar() программной платформы для создания приложений Electron связана с включением функций из недостоверной контролируемой области. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ на чтение и изменение данных

Severity

5.7 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:P/I:C/A:P

6.1 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation, Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-94 - Неверное управление генерацией кода (Внедрение кода)
CWE-829 - Включение функций из недостоверной контролируемой области

Aliases

CVE-2025-55305

References

9 references

URL
https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-loc…
https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg
https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b
https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d
https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
https://github.com/electron/electron/pull/48101
https://github.com/electron/electron/pull/48102
https://github.com/electron/electron/pull/48103
https://github.com/electron/electron/pull/48104

Impacted products

1 product from 1 vendor

Vendors

Electron

Products

Electron

Versions

до 35.7.5 (Electron), до 36.8.1 (Electron), до 37.3.1 (Electron), до 38.0.0-beta.6 (Electron)

Product types

Application software

Mitigations

Использование рекомендаций: https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1 https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:P/I:C/A:P",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Electron",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 35.7.5 (Electron), \u0434\u043e 36.8.1 (Electron), \u0434\u043e 37.3.1 (Electron), \u0434\u043e 38.0.0-beta.6 (Electron)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b\t\t\nhttps://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1\t\t\nhttps://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d\t\t\nhttps://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "19.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "15.10.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "15.10.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-12971",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-55305",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Electron",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 embeddedAsarIntegrityValidation() \u0438 onlyLoadAppFromAsar() \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Electron, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430 (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430) (CWE-94), \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0438\u0437 \u043d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 (CWE-829)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 embeddedAsarIntegrityValidation() \u0438 onlyLoadAppFromAsar() \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Electron \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0438\u0437 \u043d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/\nhttps://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg\nhttps://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b\t\t\nhttps://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d\t\nhttps://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee\t\nhttps://github.com/electron/electron/pull/48101\nhttps://github.com/electron/electron/pull/48102\t\nhttps://github.com/electron/electron/pull/48103\t\nhttps://github.com/electron/electron/pull/48104",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-94, CWE-829",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,7)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,1)"
}

FKIE_CVE-2025-55305

Vulnerability from fkie_nvd - Published: 2025-09-04 23:15 - Updated: 2026-10-19 17:10

Severity

6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b
	security-advisories@github.com	https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1
	security-advisories@github.com	https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d
	security-advisories@github.com	https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
	security-advisories@github.com	https://github.com/electron/electron/pull/48101
	security-advisories@github.com	https://github.com/electron/electron/pull/48102
	security-advisories@github.com	https://github.com/electron/electron/pull/48103
	security-advisories@github.com	https://github.com/electron/electron/pull/48104
	security-advisories@github.com	https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 35.7.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 36.0.0-alpha.1, \u003c 36.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 37.0.0-alpha.1, \u003c 37.3.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 38.0.0-alpha.1, \u003c 38.0.0-beta.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6."
    },
    {
      "lang": "es",
      "value": "Electron es un framework para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. En versiones anteriores a 35.7.5, 36.0.0-alpha.1 hasta 36.8.0, 37.0.0-alpha.1 hasta 37.3.1 y 38.0.0-alpha.1 hasta 38.0.0-beta.6, Omisi\u00f3n de la Integridad de ASAR mediante modificaci\u00f3n de recursos. Esto solo afecta a las aplicaciones que tienen las fusibles embeddedAsarIntegrityValidation y onlyLoadAppFromAsar habilitados. Las aplicaciones sin estos fusibles habilitados no se ven afectadas. Este problema est\u00e1 solucionado en las versiones 35.7.5, 36.8.1, 37.3.1 y 38.0.0-beta.6."
    }
  ],
  "id": "CVE-2025-55305",
  "lastModified": "2026-10-19T17:10:00.173",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-55305",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-05T15:44:19.972893Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-04T23:15:33.520",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/48101"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/48102"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/48103"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/48104"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VMQV-HX8Q-J7MG

Vulnerability from github – Published: 2025-09-03 21:27 – Updated: 2025-09-05 16:10

Summary

Electron has ASAR Integrity Bypass via resource modification

Details

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the resources folder in your app installation on Windows which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

38.0.0-beta.6
37.3.1
36.8.1
35.7.5

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "35.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "36.0.0-alpha.1"
            },
            {
              "fixed": "36.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "37.0.0-alpha.1"
            },
            {
              "fixed": "37.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "38.0.0-alpha.1"
            },
            {
              "fixed": "38.0.0-beta.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55305"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-03T21:27:37Z",
    "nvd_published_at": "2025-09-04T23:15:33Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThis only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled.  Apps without these fuses enabled are not impacted.\n\nSpecifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `38.0.0-beta.6`\n* `37.3.1`\n* `36.8.1`\n* `35.7.5`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-vmqv-hx8q-j7mg",
  "modified": "2025-09-05T16:10:10Z",
  "published": "2025-09-03T21:27:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55305"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/48101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/48102"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/48103"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/48104"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron/electron"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electron has ASAR Integrity Bypass via resource modification"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-55305 (GCVE-0-2025-55305)

BDU:2025-12971 (CVE-2025-55305)

FKIE_CVE-2025-55305

GHSA-VMQV-HX8Q-J7MG

Impact

Workarounds

Fixed Versions

For more information

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour