{"id":"GHSA-vmqv-hx8q-j7mg","revision":"995be98f36de4db4ac34e7d6fc7217d0","records":[{"revision":"995be98f36de4db4ac34e7d6fc7217d0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vmqv-hx8q-j7mg","aliases":["CVE-2025-55305"],"title":"Electron has ASAR Integrity Bypass via resource modification","description":"### Impact\nThis only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled.  Apps without these fuses enabled are not impacted.\n\nSpecifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `resources` folder in your app installation on Windows which these fuses are supposed to protect against.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `38.0.0-beta.6`\n* `37.3.1`\n* `36.8.1`\n* `35.7.5`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","state":0,"publishedAt":"2025-09-03T21:27:37+00:00","modifiedAt":"2025-09-05T16:10:10+00:00","affected":[{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"35.7.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"36.0.0-alpha.1"},{"kind":"fixed","version":"36.8.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"37.0.0-alpha.1"},{"kind":"fixed","version":"37.3.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"38.0.0-alpha.1"},{"kind":"fixed","version":"38.0.0-beta.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg","https://nvd.nist.gov/vuln/detail/CVE-2025-55305","https://github.com/electron/electron/pull/48101","https://github.com/electron/electron/pull/48102","https://github.com/electron/electron/pull/48103","https://github.com/electron/electron/pull/48104","https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b","https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1","https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d","https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee","https://github.com/electron/electron"],"sourceUrl":"https://github.com/advisories/GHSA-vmqv-hx8q-j7mg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vmqv-hx8q-j7mg","identifiers":["GHSA-vmqv-hx8q-j7mg","CVE-2025-55305"]},"retained":false,"historicalAffected":[]}],"coverage":[]}