CVE-2022-29257

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.

• CWE-20

• https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97Third Party Advisory
• https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7
• CVE-2022-29254silverstripe-omnipay is a SilverStripe integration with Omni…6.5
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29256sharp is an application for Node.js image processing. Prior …6.7
• CVE-2022-29258XWiki Platform Filter UI provides a generic user interface t…6.1
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9
• CVE-2022-29262Improper buffer restrictions in some Intel(R) Server Board B…6.7
• CVE-2022-29263On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x v…7.8
• CVE-2022-29264An issue was discovered in coreboot 4.13 through 4.16. On AP…9.8
• CVE-2022-29265Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not re…7.5