Search for vulnerabilities
Vulnerability details: VCID-5mrt-9uf4-aaan
Vulnerability ID VCID-5mrt-9uf4-aaan
Aliases CVE-2023-44402
GHSA-7m48-wc93-9g85
Summary Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-345 Insufficient Verification of Data Authenticity
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00023 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00050 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
epss 0.00115 https://api.first.org/data/v1/epss?cve=CVE-2023-44402
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7m48-wc93-9g85
cvssv3.1 8.8 https://github.com/electron/electron
generic_textual HIGH https://github.com/electron/electron
cvssv3.1 6.1 https://github.com/electron/electron/pull/39788
generic_textual MODERATE https://github.com/electron/electron/pull/39788
cvssv3.1 6.1 https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85
generic_textual MODERATE https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85
cvssv3 7.0 https://nvd.nist.gov/vuln/detail/CVE-2023-44402
cvssv3.1 7.0 https://nvd.nist.gov/vuln/detail/CVE-2023-44402
cvssv3.1 6.1 https://www.electronjs.org/docs/latest/tutorial/fuses
generic_textual MODERATE https://www.electronjs.org/docs/latest/tutorial/fuses
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-44402
https://github.com/electron/electron
https://github.com/electron/electron/pull/39788
https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85
https://www.electronjs.org/docs/latest/tutorial/fuses
cpe:2.3:a:electronjs:electron:27.0.0:alpha1:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:27.0.0:alpha2:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:27.0.0:alpha3:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:27.0.0:alpha4:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:27.0.0:alpha5:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:27.0.0:alpha6:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:27.0.0:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*
CVE-2023-44402 https://nvd.nist.gov/vuln/detail/CVE-2023-44402
GHSA-7m48-wc93-9g85 https://github.com/advisories/GHSA-7m48-wc93-9g85
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L Found at https://github.com/electron/electron/pull/39788
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L Found at https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-44402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-44402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L Found at https://www.electronjs.org/docs/latest/tutorial/fuses
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.03474
EPSS Score 0.00022
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-01-03T17:13:19.046776+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2023-44402 34.0.0rc1