{"id":"GHSA-22mq-c535-7vv9","kind":"vulnerability","aliases":["GHSA-22mq-c535-7vv9"],"related":[],"title":"Out-of-package denial-of-service for CommonJS Electron apps packaged with ASAR","description":"### Impact\nA CommonJS app packaged in an ASAR archive could be prevented from launching by a `package.json` in a directory above the app, for example one that is malformed or declares `\"type\": \"module\"`. Because that file is outside the app's own package, a local user able to write to an ancestor directory of the install location could stop the app from starting.\n\nApps are only affected on Electron 35 and 36 if their main-process entry point is CommonJS and packaged in an ASAR archive. Apps whose entry point is an ES module are not affected.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `36.0.0-alpha.5`\n* `35.1.0`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"A CommonJS Electron app packaged in an ASAR archive can be prevented from starting by a package.json file in a directory above the app. A local user who can write to an ancestor directory of the install location can stop the app from launching.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["36.0.0-alpha.5"],"affected":">= 36.0.0-alpha.1, < 36.0.0-alpha.5","ecosystem":"npm"},{"name":"electron","fixed":["35.1.0"],"affected":">= 35.0.0-alpha.1, < 35.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-427","desktop-apps","electron","linux","macos","runtime","windows"],"not_affected_if":["electron-not-35-or-36","esm-entry-point","non-asar-packaging"],"how_to_check":"- Check the Electron version in the app's dependencies, for example `npm ls electron`\n- Confirm whether the main-process entry point is CommonJS and the app is packaged as ASAR; ES module entry points are not affected\n- Look for a `package.json` in directories above the install location that is malformed or sets `\"type\": \"module\"`","fix":"- Electron `35.1.0`\n- Electron `36.0.0-alpha.5`\n- The advisory states there are no app-side workarounds","status":"open","published_at":"2026-10-15T21:30:18+00:00","first_seen_at":"2026-11-09T22:53:18+00:00","triaged_at":"2026-11-09T22:56:21+00:00","updated_at":"2026-11-09T22:56:21+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T22:56:21Z","model":"claude-haiku-5-5","output":{"fix":"- Electron `35.1.0`\n- Electron `36.0.0-alpha.5`\n- The advisory states there are no app-side workarounds","reach":"local","title":"Electron: a stray parent package.json can stop packaged apps from launching","impact":"low","summary":"A CommonJS Electron app packaged in an ASAR archive can be prevented from starting by a package.json file in a directory above the app. A local user who can write to an ancestor directory of the install location can stop the app from launching.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["electron","desktop-apps","windows","macos","linux"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Local user can prevent the app from launching.","analyst_note":"","how_to_check":"- Check the Electron version in the app's dependencies, for example `npm ls electron`\n- Confirm whether the main-process entry point is CommonJS and the app is packaged as ASAR; ES module entry points are not affected\n- Look for a `package.json` in directories above the install location that is malformed or sets `\"type\": \"module\"`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["esm-entry-point","non-asar-packaging","electron-not-35-or-36"],"who_is_affected":"Only Electron 35 and 36 apps whose main-process entry point is CommonJS and that are packaged in an ASAR archive are exposed. The attacker must be a local user able to write to a directory above the app's install location. Apps with ES module entry points are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4863,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-427':29B '22mq':18A,23A '35':151C '35.1.0':200C '36':153C '36.0.0':198C '7vv9':20A,25A 'abl':128C 'advisori':213C 'affect':148C,179C 'alpha.5':199C 'ancestor':70B,133C 'app':12A,32B,41B,61B,79B,85C,104C,121C,142C,145C,169C,184C 'archiv':46B,90C,168C 'asar':15A,45B,89C,167C 'c535':19A,24A 'comment':210C 'commonj':10A,39B,84C,162C 'could':91C,139C 'cwe':28B 'declar':112C 'denial':6A 'denial-of-servic':5A 'desktop':31B 'desktop-app':30B 'directori':58B,71B,101C,134C 'electron':11A,26A,27A,33B,40B,150C,195C 'email':214C 'entri':159C,171C 'es':175C 'exampl':106C 'file':55B,117C 'fix':196C 'ghsa':17A,22A 'ghsa-22mq-c535-7vv9':16A,21A 'impact':82C 'inform':203C 'instal':74B,137C 'launch':81B,95C 'linux':34B 'local':63B,126C 'locat':75B,138C 'maco':35B 'mailto':218C 'main':157C 'main-process':156C 'malform':110C 'modul':114C,176C 'must':188C 'one':107C 'out-of-packag':1A 'outsid':119C 'packag':4A,13A,42B,86C,124C,164C 'package.json':54B,98C 'patch':192C 'point':160C,172C 'prevent':49B,93C 'process':158C 'question':208C 'runtim':36B 'security@electronjs.org':217C,219C 'servic':8A 'side':185C 'start':51B,144C 'stop':77B,140C 'type':113C 'updat':189C 'us':215C 'user':64B,127C 'version':193C,197C 'whose':170C 'window':37B 'workaround':180C,186C 'write':67B,130C","nicknames":[],"mitigations":[],"who_affected":"Only Electron 35 and 36 apps whose main-process entry point is CommonJS and that are packaged in an ASAR archive are exposed. The attacker must be a local user able to write to a directory above the app's install location. Apps with ES module entry points are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["electron"],"ptokens":["electron"],"labels":["cwe427","desktopapps","electron","linux","macos","medium","npm","runtime","windows"],"campaign_type":null,"search_a":"'22mq':18A,23A '7vv9':20A,25A 'app':12A 'asar':15A 'c535':19A,24A 'commonj':10A 'denial':6A 'denial-of-servic':5A 'electron':11A,26A,27A 'ghsa':17A,22A 'ghsa-22mq-c535-7vv9':16A,21A 'out-of-packag':1A 'packag':4A,13A 'servic':8A","search_b":"'-427':29B 'ancestor':70B 'app':32B,41B,61B,79B 'archiv':46B 'asar':45B 'commonj':39B 'cwe':28B 'desktop':31B 'desktop-app':30B 'directori':58B,71B 'electron':33B,40B 'file':55B 'instal':74B 'launch':81B 'linux':34B 'local':63B 'locat':75B 'maco':35B 'packag':42B 'package.json':54B 'prevent':49B 'runtim':36B 'start':51B 'stop':77B 'user':64B 'window':37B 'write':67B","search_c":"'35':151C '35.1.0':200C '36':153C '36.0.0':198C 'abl':128C 'advisori':213C 'affect':148C,179C 'alpha.5':199C 'ancestor':133C 'app':85C,104C,121C,142C,145C,169C,184C 'archiv':90C,168C 'asar':89C,167C 'comment':210C 'commonj':84C,162C 'could':91C,139C 'declar':112C 'directori':101C,134C 'electron':150C,195C 'email':214C 'entri':159C,171C 'es':175C 'exampl':106C 'file':117C 'fix':196C 'impact':82C 'inform':203C 'instal':137C 'launch':95C 'local':126C 'locat':138C 'mailto':218C 'main':157C 'main-process':156C 'malform':110C 'modul':114C,176C 'must':188C 'one':107C 'outsid':119C 'packag':86C,124C,164C 'package.json':98C 'patch':192C 'point':160C,172C 'prevent':93C 'process':158C 'question':208C 'security@electronjs.org':217C,219C 'side':185C 'start':144C 'stop':140C 'type':113C 'updat':189C 'us':215C 'user':127C 'version':193C,197C 'whose':170C 'workaround':180C,186C 'write':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-15T21:30:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-22mq-c535-7vv9","url":"https://github.com/electron/electron/security/advisories/GHSA-22mq-c535-7vv9","severity":"medium","published_at":"2026-10-15T21:30:18+00:00","modified_at":"2026-10-15T21:30:18+00:00","first_seen_at":"2026-11-09T22:53:18+00:00","fetched_at":"2026-11-09T22:53:18+00:00","note":null}],"documents":[{"id":110482,"url":"https://github.com/electron/electron/security/advisories/GHSA-22mq-c535-7vv9","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}