{"id":"CVE-2020-15096","details":"In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using \"contextIsolation\" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.","aliases":["GHSA-6vrv-94jv-crrg"],"modified":"2026-08-07T11:30:59.689742890Z","published":"2020-07-07T00:15:10.417Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"9.0.0-beta1"},{"last_affected":"9.0.0-beta1"},{"introduced":"9.0.0-beta10"},{"last_affected":"9.0.0-beta10"},{"introduced":"9.0.0-beta11"},{"last_affected":"9.0.0-beta11"},{"introduced":"9.0.0-beta12"},{"last_affected":"9.0.0-beta12"},{"introduced":"9.0.0-beta13"},{"last_affected":"9.0.0-beta13"},{"introduced":"9.0.0-beta14"},{"last_affected":"9.0.0-beta14"},{"introduced":"9.0.0-beta15"},{"last_affected":"9.0.0-beta15"},{"introduced":"9.0.0-beta16"},{"last_affected":"9.0.0-beta16"},{"introduced":"9.0.0-beta17"},{"last_affected":"9.0.0-beta17"},{"introduced":"9.0.0-beta18"},{"last_affected":"9.0.0-beta18"},{"introduced":"9.0.0-beta19"},{"last_affected":"9.0.0-beta19"},{"introduced":"9.0.0-beta2"},{"last_affected":"9.0.0-beta2"},{"introduced":"9.0.0-beta20"},{"last_affected":"9.0.0-beta20"},{"introduced":"9.0.0-beta3"},{"last_affected":"9.0.0-beta3"},{"introduced":"9.0.0-beta4"},{"last_affected":"9.0.0-beta4"},{"introduced":"9.0.0-beta5"},{"last_affected":"9.0.0-beta5"},{"introduced":"9.0.0-beta6"},{"last_affected":"9.0.0-beta6"},{"introduced":"9.0.0-beta7"},{"last_affected":"9.0.0-beta7"},{"introduced":"9.0.0-beta8"},{"last_affected":"9.0.0-beta8"},{"introduced":"9.0.0-beta9"},{"last_affected":"9.0.0-beta9"}],"source":"CPE_STRING","vendor_product":"electronjs:electron","cpes":["cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg"},{"type":"ADVISORY","url":"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/electron/electron","events":[{"introduced":"0"},{"fixed":"aa863bc323d8ddfcae9e1211d9c2cb05f1f77c46"},{"introduced":"3083693e67632720b8d12b32d3811be0f4336318"},{"fixed":"0552e0d5de46ffa3b481d741f1db5c779e201565"},{"introduced":"1af3a71fdbb3130fd581b12d8f5a7440e7a04fc6"},{"fixed":"d8f90444aa654f886016a22cb771df99c3616178"},{"introduced":"4da01641ce50cf5a8b6f39717e4c447f89455dfa"},{"last_affected":"4da01641ce50cf5a8b6f39717e4c447f89455dfa"}],"database_specific":{"cpe":["cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*","cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"6.1.1"},{"introduced":"7.0.0"},{"fixed":"7.2.4"},{"introduced":"8.0.0"},{"fixed":"8.2.4"},{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["9.0.0-NA","v9.0.0","v7.2.3","v8.2.3","v8.2.2","v7.2.2","v8.2.1","v7.2.1","v8.2.0","v7.2.0","v8.1.1","v8.1.0","v8.0.3","v7.1.14","v8.0.2","v7.1.13","v8.0.1","v7.1.12","v8.0.0","v7.1.11","v7.1.10","v7.1.9","v7.1.8","v7.1.7","v7.1.6","v7.1.5","v7.1.4","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.1","v6.1.0","v7.0.0","v6.0.12","v6.0.11","v6.0.10","v6.0.9","v6.0.8","v6.0.7","v6.0.6","v6.0.5","v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v6.0.0-beta.15","v6.0.0-beta.14","v6.0.0-beta.13","v6.0.0-beta.12","v6.0.0-beta.11","v6.0.0-beta.10","v6.0.0-beta.9","v6.0.0-beta.8","v6.0.0-beta.7","v6.0.0-beta.6","v6.0.0-beta.5","v6.0.0-beta.4","v6.0.0-beta.3","v6.0.0-beta.2","v6.0.0-beta.1","v6.0.0-nightly.20190404","v6.0.0-nightly.20190311","v6.0.0-nightly.20190308","v6.0.0-nightly.20190227","v6.0.0-nightly.20190213","v6.0.0-nightly.20190212","v6.0.0-nightly.20190123","v5.0.0-nightly.20190122","v5.0.0-nightly.20190121","v5.0.0-nightly.20190107","v4.0.0-nightly.20181010","v4.0.0-nightly.20181006","v4.0.0-nightly.20180929","v4.0.0-nightly.20180905","v4.0.0-nightly.20180823","v4.0.0-nightly.20180821","v4.0.0-nightly.20180819","v4.0.0-nightly.20180817","v4.0.0-nightly.20180816","v1.8.2-beta.3","v1.8.2-beta.2","v1.8.2-beta.1","v1.8.1","v1.8.0","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.6.9","v1.7.0","v1.6.8","v1.6.7","v1.6.6","v1.4.15","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.14","v1.4.13","v1.4.12","v1.4.11","v1.4.10","v1.4.9","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.3.6","v1.4.1","v1.4.0","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.1","v1.2.3","v1.2.2","v1.2.0","v1.1.2","v1.1.1","v1.1.0","v1.0.2","v0.37.8","v0.37.7","v0.37.6","v0.37.5","v0.37.4","v0.37.3","v0.36.11","v0.37.2","v0.37.1","v0.37.0","v0.36.10","v0.36.9","v0.36.8","v0.36.7","v0.36.6","v0.36.5","v0.36.4","v0.36.3","v0.35.4","v0.36.2","v0.36.1","v0.36.0","v0.35.3","v0.35.2","v0.34.3","v0.35.1","v0.35.0","v0.34.2","v0.34.1","v0.34.0","v0.33.9","v0.33.8","v0.33.7","v0.33.4","v0.33.3","v0.33.2","v0.33.1","v0.33.0","v0.32.3","v0.32.2","v0.32.1","v0.32.0","v0.31.2","v0.31.1","v0.31.0","v0.30.5","v0.30.4","v0.30.3","v0.30.2","v0.30.1","v0.30.0","v0.29.2","v0.29.1","v0.29.0","v0.28.3","v0.28.2","v0.28.1","v0.26.0","v0.28.0","v0.27.3","v0.27.2","v0.27.1","v0.27.0","v0.26.1","v0.25.3","v0.25.2","v0.25.1","v0.25.0","v0.24.0","v0.23.0","v0.22.3","v0.22.2","v0.22.1","v0.22.0","v0.21.3","v0.21.2","v0.21.1","v0.21.0","v0.20.8","v0.20.7","v0.20.6","v0.20.5","v0.20.4","v0.20.3","v0.20.2","v0.20.1","v0.20.0","v0.19.5","v0.19.4","v0.19.3","v0.19.2","v0.19.1","v0.19.0","v0.18.2","v0.18.1","v0.18.0","v0.17.2","v0.17.1","v0.17.0","v0.16.3","v0.16.2","v0.16.1","v0.16.0","v0.15.9","v0.15.8","v0.15.7","v0.15.6","v0.15.5","v0.15.4","v0.15.3","v0.15.2","v0.15.1","v0.15.0","v0.14.3","v0.14.2","v0.14.1","v0.14.0","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.7","v0.12.6","v0.12.5","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.10","v0.11.9","v0.11.8","v0.11.7","v0.11.6","v0.11.5","v0.11.4","v0.11.3","v0.11.2","v0.11.1","v0.11.0","v0.10.7","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.12","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.9","v0.4.8","v0.4.7","v0.4.6","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.0","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.1","v0.2.0","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15096.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"}]}