-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from Electron's context bridge implementation failing to properly validate() nested unserializable return values. The core exposure mechanisms (exposeInMainWorld/exposeInIsolatedWorld) are the entry points for this vulnerability when they return values containing unserializable objects (e.g., canvas contexts) or objects with dynamic getters that throw errors. These functions are explicitly called out in the advisory as the vectors for exploitation, and their presence enables the bypass by design when improperly used. The CWE-754 mapping confirms the lack of proper validation for exceptional conditions during serialization.
Ongoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| electron | npm | < 22.3.6 | 22.3.6 |
| electron | npm | >= 23.0.0-alpha.1, < 23.2.3 | 23.2.3 |
| electron | npm | >= 24.0.0-alpha.1, < 24.0.1 | 24.0.1 |
| electron | npm | >= 25.0.0-alpha.1, < 25.0.0-alpha.2 | 25.0.0-alpha.2 |