CVE-2025-55305

mediumpriority · track · 0EPSS 0.003 · 20 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.28% (20th) EPSS

CVSS 6.1 · medium

Is it mine?

12 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumAV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · security-advisories@github.comexploitability 1.3 · impact 4.7

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:Lsecondary · OSV

v3.15.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-829USCWE-829USCWE-829USCWE-94USCWE-94USCWE-94US

affected products (12)

Products and version ranges known to be affected.

Electron Electron≤ < 35.7.5enisa_euvdEU
Electron Electron36.0.0-alpha.1, → 36.8.1enisa_euvdEU
Electron Electron37.0.0-alpha.1, → 37.3.1enisa_euvdEU
Electron Electron38.0.0-alpha.1, → 38.0.0-beta.6enisa_euvdEU
Electron Electron≤ 36.8.1fstec_bduRU
Electron Electron≤ 38.0.0-beta.6fstec_bduRU
Electron Electron≤ 37.3.1fstec_bduRU
Electron Electron≤ 35.7.5fstec_bduRU
npm electron< 35.7.5osvUSpkg:npm/electron
npm electron36.0.0-alpha.1 → 36.8.1osvUSpkg:npm/electron
npm electron37.0.0-alpha.1 → 37.3.1osvUSpkg:npm/electron
npm electron38.0.0-alpha.1 → 38.0.0-beta.6osvUSpkg:npm/electron

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-vmqv-hx8q-j7mgElectron has ASAR Integrity Bypass via resource modification2025-09-03ghsa · osvUS
### Impact This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled. Apps without these fuses enabled are not impacted. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `38.0.0-beta.6` * `37.3.1` * `36.8.1` * `35.7.5` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2025-09-04modified 2026-10-19

references (28)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan