Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-46992

CVE-2024-46992: electron ASAR Integrity bypass by just modifying the content

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-46992
GHSA ID
GHSA-xw5q-g62x-2qjc
EPSS Score
0.00396%
CWE
CWE-354
Published
6/30/2025
Updated
6/30/2025
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
electronnpm>= 30.0.0-alpha.1, < 30.0.530.0.5
electronnpm>= 31.0.0-alpha.1, < 31.0.0-beta.131.0.0-beta.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability described is an ASAR integrity bypass on Windows. I have examined the commit history between the vulnerable version 30.0.4 and the patched version 30.0.5. The commit messages in this range do not point to a clear security fix related to ASAR integrity. The changes seem to be regular bug fixes, dependency updates (Chromium), and build configuration changes. It is possible the fix is included in one of the dependency updates, but without more specific information or a dedicated security patch commit, it is not possible to identify the exact vulnerable functions with high confidence. Therefore, I cannot provide a list of vulnerable functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*l**tron's *S*R Int**rity **n ** *yp*ss *y mo*i*yin* t** *ont*nt. ### Imp**t T*is only imp**ts *pps t**t **v* t** `*m*******s*rInt**rityV*li**tion` *n* `onlyLo***pp*rom*s*r` [*us*s](*ttps://www.*l**tronjs.or*/*o*s/l*t*st/tutori*l/*us*s) *n**l**. *pp

Reasoning

T** vuln*r**ility **s*ri*** is *n *S*R int**rity *yp*ss on Win*ows. I **v* *x*min** t** *ommit *istory **tw**n t** vuln*r**l* v*rsion `**.*.*` *n* t** p*t**** v*rsion `**.*.*`. T** *ommit m*ss***s in t*is r*n** *o not point to * *l**r s**urity *ix r*
CVE-2024-46992: Electron ASAR Integrity Bypass | Miggo