CVE-2022-29247

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

• CWE-668

• https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7Third Party Advisory
• https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29241Jupyter Server provides the backend (i.e. the core services,…8.8
• CVE-2022-29242GOST engine is a reference implementation of the Russian GOS…7.5
• CVE-2022-29243Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-29244npm pack ignores root-level .gitignore and .npmignore file e…7.5
• CVE-2022-29245SSH.NET is a Secure Shell (SSH) library for .NET. In version…5.9
• CVE-2022-29246Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29248Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 …8.1
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4
• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1