Msrkp

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5 **Description** The issue is related to the `nodeIntegrationInSubFrames` parameter in Electron, which can lead to information disclosure. A renderer with JavaScript execution can obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled, allowing effective access to `ipcRenderer`. This access can compromise the application or user if the application exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data. **Recommendations** For versions prior to 18.0.0-beta.6, update to version 18.0.0-beta.6 or later. For versions prior to 17.2.0, update to version 17.2.0 or later. For versions prior to 16.2.6, update to version 16.2.6 or later. For versions prior to 15.5.5, update to version 15.5.5 or later. As a temporary workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

**Name of the Vulnerable Software and Affected Versions** Element Desktop versions prior to 1.9.7 **Description** The issue concerns a remote program execution bug that requires user interaction, involving clicking on a malicious link followed by another button click. To the best of available knowledge, this issue has not been exploited in the wild. If successfully exploited, it allows an attacker to specify a file path of a binary on the victim's computer for execution, although the attacker cannot specify program arguments. In certain configurations, the attacker may be able to specify a URI instead of a file path, potentially leading to further vulnerabilities in platform mechanisms and arbitrary code execution. **Recommendations** For Element Desktop versions prior to 1.9.7, upgrade to version 1.9.7 or later at your earliest convenience to resolve the issue. As a temporary workaround, consider avoiding clicking on suspicious links and buttons to minimize the risk of exploitation. Restrict access to potentially vulnerable configurations to reduce the risk of further vulnerabilities being exploited.

**Name of the Vulnerable Software and Affected Versions** aurelia-path versions prior to 1.1.7 **Description** The issue is related to a prototype pollution vulnerability in aurelia-path, which is part of the Aurelia platform and contains utilities for path manipulation. This vulnerability exposes Aurelia applications that use the `aurelia-path` package to parse a string, particularly those that employ the `aurelia-router` package. An example of exploitation could involve an attacker tricking an application into parsing a URL like `https://aurelia.io/blog/? proto [asdf]=asdf`, potentially allowing the attacker to change the prototype of the base object class `Object`. **Recommendations** For versions prior to 1.1.7, update to version 1.1.7 to resolve the issue. As a temporary workaround, consider using `Object.freeze(Object.prototype)` to partially mitigate the vulnerability.