CVE-2025-55305

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.

• CWE-94
• CWE-829

• https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b
• https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1
• https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d
• https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
• https://github.com/electron/electron/pull/48101
• https://github.com/electron/electron/pull/48102
• https://github.com/electron/electron/pull/48103
• https://github.com/electron/electron/pull/48104
• https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg

Published

Sep 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55299VaulTLS is a modern solution for managing mTLS (mutual TLS) …9.4
• CVE-2025-5530The WPC Smart Compare for WooCommerce plugin for WordPress i…5.4
• CVE-2025-55300Komari is a lightweight, self-hosted server monitoring tool …8.6
• CVE-2025-55301The Scratch Channel is a news website. In version 1, it is p…6.7
• CVE-2025-55303Astro is a web framework for content-driven websites. In ver…6.1
• CVE-2025-55304Exiv2 is a C++ library and a command-line utility to read, w…5.5
• CVE-2025-55306GenX_FX is an advance IA trading platform that will focus on…9.8
• CVE-2025-55307An issue was discovered in Foxit PDF and Editor for Windows …3.3
• CVE-2025-55308An issue was discovered in Foxit PDF and Editor for Windows …6.7
• CVE-2025-55309An issue was discovered in Foxit PDF and Editor for Windows …6.7
• CVE-2025-5531The Employee Directory – Staff Listing & Team Directory Plug…6.4
• CVE-2025-55310An issue was discovered in Foxit PDF and Editor for Windows …7.3