CVE-2022-36077

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.

• CWE-200
• CWE-522
• CWE-522

• https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2vMitigation, Third Party Advisory
• https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2vMitigation, Third Party Advisory

Published

Nov 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36071SFTPGo is configurable SFTP server with optional HTTP/S, FTP…8.1
• CVE-2022-36072SilverwareGames.io is a social network for users to play vid…5.9
• CVE-2022-36073RubyGems.org is the Ruby community gem host. A bug in passwo…8.8
• CVE-2022-36074Nextcloud server is an open source personal cloud product. A…7.5
• CVE-2022-36075Nextcloud files access control is a nextcloud app to manage …4.3
• CVE-2022-36076NodeBB Forum Software is powered by Node.js and supports eit…7.5
• CVE-2022-36078Binary provides encoding/decoding in Borsh and other formats…7.5
• CVE-2022-36079Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-3608Cross-site Scripting (XSS) - Stored in GitHub repository tho…8.4
• CVE-2022-36080Wikmd is a file based wiki that uses markdown. Prior to vers…6.1
• CVE-2022-36081Wikmd is a file based wiki that uses markdown. Prior to vers…7.5
• CVE-2022-36082mangadex-downloader is a command-line tool to download manga…5.3