CVE-2023-44402: ASAR Integrity Bypass in Electron
Summary
CVE-2023-44402: ASAR Integrity bypass via filetype confusion in electron. Affects electron across 6 version ranges.
< 22.3.24
>= 23.0.0-alpha.1, <= 23.3.13
>= 24.0.0-alpha.1, < 24.8.3
>= 25.0.0-alpha.1, < 25.8.1
>= 26.0.0-alpha.1, < 26.2.1
>= 27.0.0-alpha.1, < 27.0.0-alpha.7
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. However, Electron is vulnerable to an ASAR integrity bypass, which can be exploited on macOS if certain fuses are enabled.
Vulnerability Detail
The ASAR integrity bypass vulnerability in Electron affects apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. These fuses are designed to protect against tampering with the application bundle on macOS. However, if an attacker has write access to the filesystem where the app is launched from, they can exploit this vulnerability.
The impact of this vulnerability is limited to macOS and only affects apps with the specific fuses enabled. It allows an attacker to bypass the integrity checks on the ASAR archive, potentially leading to the execution of arbitrary code or unauthorized access to sensitive information.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 22.3.2422.3.24npm install electron@22.3.24 -
>= 24.0.0-alpha.1, < 24.8.324.8.3npm install electron@24.8.3 -
>= 25.0.0-alpha.1, < 25.8.125.8.1npm install electron@25.8.1 -
>= 26.0.0-alpha.1, < 26.2.126.2.1npm install electron@26.2.1 -
>= 27.0.0-alpha.1, < 27.0.0-alpha.727.0.0-alpha.7npm install electron@27.0.0-alpha.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The ASAR integrity bypass vulnerability in Electron can be mitigated by updating to a patched version of the framework. Developers should ensure that their Electron dependencies are up to date to protect against potential exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Only Electron applications with the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled on macOS are affected.
No, this vulnerability is specific to macOS as the fuses in question are only supported on macOS.
The impact is limited to apps with the specific fuses enabled on macOS. It allows an attacker to bypass ASAR integrity checks and potentially execute arbitrary code or gain unauthorized access to sensitive information.
No, there are no app-side workarounds for this vulnerability. Updating to a patched version of Electron is the recommended solution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
