CVE-2024-39698

electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.

• CWE-154
• CWE-295

• https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41Product
• https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427fPatch
• https://github.com/electron-userland/electron-builder/pull/8295Issue Tracking, Patch
• https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxqExploit, Vendor Advisory
• https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41Product
• https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427fPatch
• https://github.com/electron-userland/electron-builder/pull/8295Issue Tracking, Patch
• https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxqExploit, Vendor Advisory

Published

Jul 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39691matrix-appservice-irc is a Node.js IRC bridge for the Matrix…4.3
• CVE-2024-39693Next.js is a React framework. A Denial of Service (DoS) cond…7.5
• CVE-2024-39694Duende IdentityServer is an OpenID Connect and OAuth 2.x fra…4.7
• CVE-2024-39695Exiv2 is a command-line utility and C++ library for reading,…6.5
• CVE-2024-39696Evmos is a decentralized Ethereum Virtual Machine chain on t…8.1
• CVE-2024-39697phonenumber is a library for parsing, formatting and validat…8.6
• CVE-2024-39699Directus is a real-time API and App dashboard for managing S…5
• CVE-2024-3970Server Side Request Forgery vulnerability has been discovere…7.5
• CVE-2024-39700JupyterLab extension template is a `copier` template for Ju…9.8
• CVE-2024-39701Directus is a real-time API and App dashboard for managing S…7.7
• CVE-2024-39702In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the…5.9
• CVE-2024-39703In ThreatQuotient ThreatQ before 5.29.3, authenticated users…8.8