Skip to content

Build process memory potentially leaked into final executable

Critical
MarshallOfSound published GHSA-34h3-8mw4-qw57 Mar 28, 2024

Package

npm @electron/packager (npm)

Affected versions

18.3.0

Patched versions

18.3.1

Description

Impact

A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such as environment variables, secrets files, etc.

Patches

This issue is patched in 18.3.1

Workarounds

No workarounds, please update to a patched version of @electron/packager immediately if impacated.

Severity

Critical

CVE ID

CVE-2024-29900

Weaknesses

No CWEs