CVE-2023-44402

highpriority · track · 28OT risk · elevatedEPSS 0.002 · 11 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (11th) EPSS

CVSS 7 · high

Is it mine?

18 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.

cvss

Technical severity, 0–10. One row per scoring source.

7.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.1–7

v3.17highCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1 · impact 5.9

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · security-advisories@github.comexploitability 1.3 · impact 4.7

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · OSV

v3.16.4mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-345USCWE-345US

affected products (18)

Products and version ranges known to be affected.

Electron Electron≤ 23.0.0-alpha.1, ≤ 23.3.13enisa_euvdEU
Electron Electron≤ < 22.3.24enisa_euvdEU
Electron Electron24.0.0-alpha.1, → 24.8.3enisa_euvdEU
Electron Electron25.0.0-alpha.1, → 25.8.1enisa_euvdEU
Electron Electron26.0.0-alpha.1, → 26.2.1enisa_euvdEU
Electron Electron27.0.0-alpha.1, → 27.0.0-alpha.7enisa_euvdEU
electronjs electron≤ 22.3.24nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjs electron23.0.0 → 23.3.14nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjs electron24.0.0 → 24.8.3nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjs electron25.0.0 → 25.8.1nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjs electron26.0.0 → 26.2.1nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjs electron= 27.0.0nvdUScpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
npm electron< 22.3.24osvUSpkg:npm/electron
npm electron23.0.0-alpha.1 → 23.3.13osvUSpkg:npm/electron
npm electron24.0.0-alpha.1 → 24.8.3osvUSpkg:npm/electron
npm electron25.0.0-alpha.1 → 25.8.1osvUSpkg:npm/electron
npm electron26.0.0-alpha.1 → 26.2.1osvUSpkg:npm/electron
npm electron27.0.0-alpha.1 → 27.0.0-alpha.7osvUSpkg:npm/electron

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-7m48-wc93-9g85ASAR Integrity bypass via filetype confusion in electron2023-12-01ghsa · osvUS
### Impact This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `27.0.0-alpha.7` * `26.2.1` * `25.8.1` * `24.8.3` * `22.3.24` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2023-12-01modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan