Recent searches
Search options
@TomSellers Note that Electron patched this back to v22 and forward to v26 and v27 (in beta), not just v24 and v25; the fixed versions are:
22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-beta.2
@delfuego @TomSellers @electronjs Expanded to check against all #libwebp-patched #Electron versions:
find /Applications -type f -name '*Electron Framework*' -exec \
perl -Mversion=0.77 -nE \
'@safe = map version->parse($_), qw(22.3.24 24.8.3 25.8.1 26.2.1);
next unless m{Chrome/[0-9.]+ Electron/([0-9.]+)}; $ver = version->parse($1);
if ($ver < (grep int $_->numify >= int $ver->numify, @safe)[0]) {
say "vulnerable Electron $ver found in $ARGV"; next
}' {} \;
@delfuego @TomSellers (I am not checking betas because WTF are you doing installing #Electron apps with beta Electron?)
@mjgardner @delfuego @TomSellers this is not fully rigorous it doesn't notify for example on electron 19.x use, unless I'm mistaken...
@toba @delfuego @TomSellers True. I have fixed the original post.
N.B. #Electron only supports the last three major versions and version 22 per https://www.electronjs.org/docs/latest/tutorial/electron-timelines#version-support-policy so fixes for v23 and anything below v22 will not come from @electronjs
@delfuego @TomSellers @electronjs After using the above command and pulling down any available updates, I still have the following vulnerable #Electron-based apps on my #Mac:
#AdGuard for #Safari (Electron v18.3.15)
#HTTPie (21.2.0)
#Jabra Direct (16.2.2)
#Keybase (22.1.0)
#Logitech Logi Options+ (23.1.1)
#Logseq (24.6.3)
#Postman (18.3.5) @getpostman
#Rancher Desktop (20.3.8)
#Microsoft Teams (19.1.8)
#WhatsApp (13.6.9)
@delfuego @TomSellers @electronjs @getpostman Some of those numbers are deceptively lower than the current supported #Electron releases: https://www.electronjs.org/docs/latest/tutorial/electron-timelines
But they all include Electron versions released in the past 18 months.
Like a lot of #JavaScript apps, Electron iterates versions *really* fast. #SemanticVersioning is *not* a guide to the chronological age of software, only its compatibility with *other* software.
@mjgardner @delfuego @TomSellers @electronjs @getpostman
I see that Microsoft also uses Electron 19.1.8 in #Skype! (Seems like there might be a vector to attack that, somehow, since one can send messages to another user?)
[Edit: #VisualStudioCode is vulnerable with 22.3.14 -- incorrect, I hadn't updated this one]
Contrary to what I see in the release notes, my updated #Obsidian is on 25.8.0 (not .1)
#RStudio has 25.5.0
@alancheilek @mjgardner @TomSellers @electronjs @getpostman VS Code definitely is no longer vulnerable; version 1.82.2, released *two weeks ago*, remediated.