Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Openjsf |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-0797 | Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1. |
 Github GHSA |
GHSA-34h3-8mw4-qw57 | @electron/packager's build process memory potentially leaked into final executable |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 07 May 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openjsf
Openjsf packager |
|
| Weaknesses | NVD-CWE-Other | |
| CPEs | cpe:2.3:a:openjsf:packager:18.3.0:*:*:*:*:node.js:*:* | |
| Vendors & Products |
Openjsf
Openjsf packager |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T01:17:58.508Z
Reserved: 2024-03-21T15:12:08.999Z
Link: CVE-2024-29900
Vulnrichment
Updated: 2024-08-02T01:17:58.508Z
NVD
Status : Analyzed
Published: 2024-03-29T16:15:08.103
Modified: 2025-05-07T17:02:49.973
Link: CVE-2024-29900
Redhat
No data.
OpenCVE Enrichment
No data.