CVE-2020-4077
Estado: ModificadaCrítica (9.9)—
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Puntuación base: 9.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.00%
- Percentil entre todas las CVEs puntuadas: 62
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-501
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-4077",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.7,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.9,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 3.1
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "electron",
"product": "electron",
"versions": [
{
"status": "affected",
"version": ">= 9.0.0-beta.0, <= 9.0.0-beta.20"
},
{
"status": "affected",
"version": ">= 8.0.0, < 8.2.4"
},
{
"status": "affected",
"version": "< 7.2.4"
}
]
}
]
}
],
"published": "2020-07-07T00:15:10.700",
"references": [
{
"url": "https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-501"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
},
{
"lang": "es",
"value": "En Electron antes de las versiones 7.2.4, 8.2.4 y 9.0.0-beta21, se presenta una omisión de aislamiento de contexto. El código que se ejecuta en el contexto mundial principal en el renderizador puede alcanzar el contexto Electron aislado y llevar a cabo acciones privilegiadas. Las aplicaciones que usan tanto \"contextIsolation\" como \"contextBridge\" están afectadas. Esto es corregido en las versiones 9.0.0-beta.21, 8.2.4 y 7.2.4"
}
],
"lastModified": "2026-06-17T03:19:31.783",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B52CBB9A-2E1B-4ED7-8DAD-33B5CD063D45",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "7.0.0"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31A476AD-CF63-41DE-8B71-7CB8CB828BA7",
"versionEndExcluding": "8.2.4",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87556FB9-4AEC-4C3A-8DF6-4480728C8605"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB793B7F-1C9D-445D-A849-CB28577CA760"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C340AA9-8D81-4927-9447-DFCF0DD385AC"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8DF366B-644E-4C43-9DF1-37F1ADD36532"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAC64CED-4F36-4667-B909-4265DDEBDA3F"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17574861-A808-406A-9B0D-403AD99EA160"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79CB734A-05B3-4388-BD8F-ECD3FD699D87"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E0E7E72-B138-4E09-BEE0-219643377314"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B19F82AA-3660-4AC5-920E-7E36534ADF36"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29850E51-1EB9-4E9E-9AAC-ACAC12CDCAB6"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84544C05-24A7-4CDE-B6E1-EC05B6CD9836"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8AF3443-F01C-407F-BEE2-A8E601A09211"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F962D5DC-C4EE-42C0-9BA8-C17B5ADAE178"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB7A193D-7B1F-45F0-B385-DE8C75D7088D"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BFFB27D-B11F-4F5B-8624-27042F8A664A"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF67CE0D-79D8-4CCC-8152-6989D681B618"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "965FE481-DC51-4123-B47A-4825E7231B33"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAC42DF7-3344-4C5C-B01A-B24F7C7FA47A"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CA4015A-6D70-490E-AEFD-1C64F582F9DA"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72B0EAB3-F11C-42B3-8F4A-3D4B652A2740"
},
{
"criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2F409DE-D2A1-49A6-AA57-D735F4B07D29"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}