CVE-2021-39184

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.

• CWE-668
• CWE-862

• https://github.com/electron/electron/pull/30728Third Party Advisory
• https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4Mitigation, Third Party Advisory
• https://github.com/electron/electron/pull/30728Third Party Advisory
• https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4Mitigation, Third Party Advisory

Published

Oct 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39179DHIS 2 is an information system for data capture, management…8.8
• CVE-2021-3918json-schema is vulnerable to Improperly Controlled Modificat…9.8
• CVE-2021-39180OpenOLAT is a web-based learning management system (LMS). A …8.8
• CVE-2021-39181OpenOlat is a web-based learning management system (LMS). Pr…8.8
• CVE-2021-39182EnroCrypt is a Python module for encryption and hashing. Pri…7.5
• CVE-2021-39183Owncast is an open source, self-hosted live video streaming …6.1
• CVE-2021-39185Http4s is a minimal, idiomatic Scala interface for HTTP serv…9.1
• CVE-2021-39186GlobalNewFiles is a MediaWiki extension maintained by Mirahe…6.1
• CVE-2021-39187Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3