CVE-2022-29257

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-292586.1XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for CVE-2022-29264.9The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as ad CVE-2022-292626.7Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of pri CVE-2022-292637.8On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr CVE-2022-292649.8An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur.CVE-2022-292657.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard CVE-2022-292667.5In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned CVE-2022-292696.5In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformat CVE-2022-29279.8Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.CVE-2022-292704.3In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.CVE-2022-292716.5In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/service CVE-2022-292726.1In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.