{"id":"GHSA-vmqv-hx8q-j7mg","summary":"Electron has ASAR Integrity Bypass via resource modification","details":"### Impact\nThis only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled.  Apps without these fuses enabled are not impacted.\n\nSpecifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `38.0.0-beta.6`\n* `37.3.1`\n* `36.8.1`\n* `35.7.5`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","aliases":["CVE-2025-55305"],"modified":"2025-09-05T16:10:10Z","published":"2025-09-03T21:27:37Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-09-03T21:27:37Z","nvd_published_at":"2025-09-04T23:15:33Z","cwe_ids":["CWE-829","CWE-94"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55305"},{"type":"WEB","url":"https://github.com/electron/electron/pull/48101"},{"type":"WEB","url":"https://github.com/electron/electron/pull/48102"},{"type":"WEB","url":"https://github.com/electron/electron/pull/48103"},{"type":"WEB","url":"https://github.com/electron/electron/pull/48104"},{"type":"WEB","url":"https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"},{"type":"WEB","url":"https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"},{"type":"WEB","url":"https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"},{"type":"WEB","url":"https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"affected":[{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"35.7.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-vmqv-hx8q-j7mg/GHSA-vmqv-hx8q-j7mg.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"36.0.0-alpha.1"},{"fixed":"36.8.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-vmqv-hx8q-j7mg/GHSA-vmqv-hx8q-j7mg.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0-alpha.1"},{"fixed":"37.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-vmqv-hx8q-j7mg/GHSA-vmqv-hx8q-j7mg.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"38.0.0-alpha.1"},{"fixed":"38.0.0-beta.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-vmqv-hx8q-j7mg/GHSA-vmqv-hx8q-j7mg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"}]}