CVE-2020-4075

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
electron	electron	>= 9.0.0-beta.0, <= 9.0.0-beta.20; >= 8.0.0, < 8.2.4; < 7.2.4

References

https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhmThird Party Advisory
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824Release Notes, Vendor Advisory
https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhmThird Party Advisory
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824Release Notes, Vendor Advisory

Timeline

Published: Jul 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40769.0In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in t CVE-2020-40779.9In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in t CVE-2020-40797.7Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel expor CVE-2020-40806.1HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An un CVE-2020-40816.1In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).CVE-2020-40825.4The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote at CVE-2020-40835.5HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a loca CVE-2020-40845.4HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c CVE-2020-40856.5"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."CVE-2020-40896.5HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could resu CVE-2020-40925.3"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not CVE-2020-40956.0"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can