{"id":"CVE-2025-55305","aliases":["GHSA-vmqv-hx8q-j7mg"],"url":"https://o3.security/vulnerability/CVE-2025-55305","summary":"Electron is vulnerable to Code Injection via resource modification","details":"### Impact\nThis only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled.  Apps without these fuses enabled are not impacted.\n\nSpecifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `38.0.0-beta.6`\n* `37.3.1`\n* `36.8.1`\n* `35.7.5`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","published":"2025-09-04T23:05:07.274Z","modified":"2026-08-12T15:16:44.986290Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"electron","fixedVersion":"35.7.5"},{"ecosystem":"npm","name":"electron","fixedVersion":"36.8.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"37.3.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"38.0.0-beta.6"}],"fix":{"url":"https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b","label":"electron/electron@23a0293"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55305.json"},{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55305"},{"type":"FIX","url":"https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b"},{"type":"FIX","url":"https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1"},{"type":"FIX","url":"https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d"},{"type":"FIX","url":"https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee"},{"type":"FIX","url":"https://github.com/electron/electron/pull/48101"},{"type":"FIX","url":"https://github.com/electron/electron/pull/48102"},{"type":"FIX","url":"https://github.com/electron/electron/pull/48103"},{"type":"FIX","url":"https://github.com/electron/electron/pull/48104"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:16:44.986290Z"}}