Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DevTools Bug]: react-devtools depends on vulnerable version of electron #25667

Closed
slobo80 opened this issue Nov 11, 2022 · 1 comment · Fixed by #26337
Closed

[DevTools Bug]: react-devtools depends on vulnerable version of electron #25667

slobo80 opened this issue Nov 11, 2022 · 1 comment · Fixed by #26337
Assignees
@mondaychen
Labels
Component: Developer Tools Status: Unconfirmed A potential issue that we haven't yet confirmed as a bug Type: Bug

Comments

@slobo80
Copy link

slobo80 commented Nov 11, 2022

Website or app

https://github.com/facebook/react/blob/main/packages/react-devtools/package.json

Repro steps

Issue

electron package versions <18.3.7 suffer from a security vulnerability: "Exfiltration of hashed SMB credentials on Windows via file:// redirect".
See GHSA-p2jh-44qj-pf2v

Solution

Upgrade electron dependency in react-devtools to >18.3.7

How often does this bug happen?

Every time

DevTools package (automated)

No response

DevTools version (automated)

No response

Error message (automated)

No response

Error call stack (automated)

No response

Error component stack (automated)

No response

GitHub query string (automated)

No response
@slobo80 slobo80 added Component: Developer Tools Status: Unconfirmed A potential issue that we haven't yet confirmed as a bug Type: Bug labels Nov 11, 2022
@mondaychen mondaychen self-assigned this Nov 30, 2022
@a7madgamal
Copy link

yes, it's also too old that It's not working on latest MacOS. when I debugged it seems it can't open electron

@mondaychen mondaychen mentioned this issue Mar 7, 2023
Merged
mondaychen added a commit that referenced this issue Mar 8, 2023
@mondaychen
[DevTools] upgrade electron to latest version & security improvements (…
aef9303 
…#26337)

## Summary

resolves #25667
This PR also resolves several security issues in the standalone app

## How did you test this change?

Tested locally `yarn start` in react-devtools package. Everything works
normal

---
- To see the specific tasks where the Asana app for GitHub is being
used, see below:
  - https://app.asana.com/0/0/1204123419819195
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mondaychen mondaychen

Labels
Component: Developer Tools Status: Unconfirmed A potential issue that we haven't yet confirmed as a bug Type: Bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[DevTools] upgrade electron to latest version & security improvements mondaychen/react
3 participants
@a7madgamal @mondaychen @slobo80