CVE-2024-46992 Details
Description
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue.
A vulnerability allowing an ASAR integrity bypass has been identified in Electron versions 30.0.0-alpha.1 prior to 30.0.5 and 31.0.0-alpha.1 prior to 31.0.0-beta.1. This issue affects applications with the 'embeddedAsarIntegrityValidation' and 'onlyLoadAppFromAsar' fuses enabled. The vulnerability is specific to Windows; applications using these fuses on macOS are not affected. Exploitation requires launching the application from a writable filesystem, such as editing files within the .app bundle on macOS, which these fuses are intended to protect against.
Users should update to Electron versions 30.0.5 or 31.0.0-beta.1, both of which include the necessary patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2025CISA-ADP
Assessed Jul 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc | [email protected] | AdvisoryRemedyVendor |
| https://www.electronjs.org/docs/latest/tutorial/fuses | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-354 | Improper Validation of Integrity Check Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Electron | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2025 | New CVE Received | [email protected] |