What is CVE-2023-23623?

CVE-2023-23623 is a high-severity vulnerability in Electron, classified under Always-Incorrect Control Flow Implementation. CVSS score: 7.5/10. Published 2023-09-06.

How severe is CVE-2023-23623?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Electron

CVE-2023-23623

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval`…

EPSS: 0.007 (47.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Electron — versions >= 22.0.0-beta.1, < 22.0.1, >= 23.0.0-alpha.1, < 23.0.0-alpha.2
Electronjs Electron — versions 22.0.0, 23.0.0

Weakness classification (CWE)

CWE-670 — Always-Incorrect Control Flow Implementation

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2023-23623?: CVE-2023-23623 is a high-severity vulnerability in Electron, classified under Always-Incorrect Control Flow Implementation. CVSS score: 7.5/10. Published 2023-09-06.
How severe is CVE-2023-23623?: High severity. CVSS v3 base score is 7.5 out of 10.