Medium severity · published Sep 4, 2025
CVE-2025-55305
Electron is vulnerable to Code Injection via resource modification
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 35.7.5; >= 36.0.0-alpha.1, < 36.8.1; >= 37.0.0-alpha.1, < 37.3.1; >= 38.0.0-alpha.1, < 38.0.0-beta.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55305
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55305
github.com
https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b
github.com
https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1
github.com
https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d
github.com
https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
github.com
https://github.com/electron/electron/pull/48101
github.com
https://github.com/electron/electron/pull/48102
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.8
CVE-2023-23623
Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer