---
id: "GHSA-22mq-c535-7vv9"
page: "https://infrastack.ai/live/GHSA-22mq-c535-7vv9"
kind: "vulnerability"
aliases: ["GHSA-22mq-c535-7vv9"]
title: "Out-of-package denial-of-service for CommonJS Electron apps packaged with ASAR"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "electron", "fixed": ["36.0.0-alpha.5"], "affected": ">= 36.0.0-alpha.1, < 36.0.0-alpha.5", "ecosystem": "npm"}, {"name": "electron", "fixed": ["35.1.0"], "affected": ">= 35.0.0-alpha.1, < 35.1.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-427", "desktop-apps", "electron", "linux", "macos", "runtime", "windows"]
not_affected_if: ["electron-not-35-or-36", "esm-entry-point", "non-asar-packaging"]
published_at: "2026-10-15T21:30:18+00:00"
first_seen_at: "2026-11-09T22:53:18+00:00"
updated_at: "2026-11-09T22:56:21+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/electron/electron/security/advisories/GHSA-22mq-c535-7vv9", "first_seen_at": "2026-11-09T22:53:18+00:00"}]
exploit_sources: []
---

# Out-of-package denial-of-service for CommonJS Electron apps packaged with ASAR

Link for people: https://infrastack.ai/live/GHSA-22mq-c535-7vv9 (this .md is for agents)

A CommonJS Electron app packaged in an ASAR archive can be prevented from starting by a package.json file in a directory above the app. A local user who can write to an ancestor directory of the install location can stop the app from launching.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:electron affected >= 36.0.0-alpha.1, < 36.0.0-alpha.5 fixed 36.0.0-alpha.5
- npm:electron affected >= 35.0.0-alpha.1, < 35.1.0 fixed 35.1.0

## How to check

- Check the Electron version in the app's dependencies, for example `npm ls electron`
- Confirm whether the main-process entry point is CommonJS and the app is packaged as ASAR; ES module entry points are not affected
- Look for a `package.json` in directories above the install location that is malformed or sets `"type": "module"`

## Fix

- Electron `35.1.0`
- Electron `36.0.0-alpha.5`
- The advisory states there are no app-side workarounds

## Timeline

- 2026-11-09T22:53:18+00:00 ghsa-repo https://github.com/electron/electron/security/advisories/GHSA-22mq-c535-7vv9

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/electron/electron/security/advisories/GHSA-22mq-c535-7vv9

## From the sources

### Impact
A CommonJS app packaged in an ASAR archive could be prevented from launching by a `package.json` in a directory above the app, for example one that is malformed or declares `"type": "module"`. Because that file is outside the app's own package, a local user able to write to an ancestor directory of the install location could stop the app from starting.

Apps are only affected on Electron 35 and 36 if their main-process entry point is CommonJS and packaged in an ASAR archive. Apps whose entry point is an ES module are not affected.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `36.0.0-alpha.5`
* `35.1.0`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_