CVE-2024-39698 is a high-severity (CVSS 7.5) CWE-154 vulnerability in electron-updater. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for electron-updater — see the affected versions and patch details below.
Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-39698.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
electron-updaternpmDescription
Observations
The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. It executes the following command in a new shell (process.env.ComSpec on Windows, usually C:\Windows\System32\cmd.exe):
Because of the surrounding shell, a first pass by cmd.exe expands any environment variable found in command-line above.
Exploitation
This creates a situation where verifySignature() can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid.
Impact
This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.).
Patch
This vulnerability was patched in #8295, by comparing the path in the output of Get-AuthenticodeSignature with the intended one. The patch is available starting from 6.3.0-alpha.6.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | electron-updater | all versions | 6.3.0-alpha.6npm install electron-updater@6.3.0-alpha.6 |
Affected Products
electron-builderelectronResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for electron-updater, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update electron-updater to 6.3.0-alpha.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-39698 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2024-39698 in your dependencies?
Find it across npm, including transitive dependencies.