CVE-2023-39956
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedElectron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThis is a vulnerability in Electron where apps launched as command-line executables from attacker-controlled working directories can be exploited. An attacker with write access to the working directory can potentially bypass ASAR Integrity protections, allowing arbitrary file access or code execution. The specific exploitation requires the app to be launched from a directory the attacker controls.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 22.3.9>= 23.0.0, < 23.3.13>= 24.0.0, < 24.7.1>= 25.0.0, < 25.5.0= 26.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Electron versionInspect the application's dependencies (package.json) or run the app and check process.versions.electron via developer tools or consoleAffected if The installed Electron version falls outside the safe versions: 22.3.9+, 23.3.13+, 24.7.1+, 25.5.0+, or 26.0.0+ (or 26.0.0-beta.13+ for beta releases)
-
Check if ASAR integrity is enabledInspect the Electron app configuration (usually in the main process code or electron-builder config) for asar: true with asarIntegrity option set, or check if the app uses app.asarIntegrityLevel('strict') or similar integrity settingsAffected if ASAR integrity protection is explicitly enabled in the application configuration (this is the protection the bypass targets)
-
Determine typical launch working directoryReview how the application is typically launched: check desktop shortcuts, command-line launch scripts, or documentation for the intended working directoryAffected if The application is commonly launched from a directory that an untrusted user could potentially write to (e.g., downloads folder, temp directories, user-writable locations)
-
Verify current working directory at runtimeRun console.log(process.cwd()) in the Electron renderer or main process to inspect the current working directory when the app is launchedAffected if The working directory at launch is a path controlled by or writable by an untrusted party
You are affected if your Electron version is below the safe versions AND ASAR integrity is enabled AND your app can be launched from a directory an attacker can write to.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped22.3.923.3.1324.7.1
Update Electron to a patched version (22.3.19, 23.3.13, 24.7.1, 25.4.1, or 26.0.0-beta.13 or later). No application-side workarounds exist; the fix must come from the Electron framework update.
Upgrade to 22.3.19, 23.3.13, 24.7.1, or 25.4.1 (or newer stable) depending on your current major version branch
- Check current Electron version by running `npm list electron` or inspecting package.json
- Identify which version branch you're currently on (22.x, 23.x, 24.x, or 25.x)
- Run `npm install electron@<fixed-version> --save-dev` where <fixed-version> is the appropriate patched release for your branch: 22.3.19 for 22.x, 23.3.13 for 23.x, 24.7.1 for 24.x, or 25.4.1 (or newer stable) for 25.x
- Alternatively, update the electron version in package.json to the appropriate fixed version and run `npm install`
- Verify the upgrade was successful by running `npm list electron` and confirming the installed version matches the target
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,888.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-39956 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-39956 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data