When following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.

Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.

Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.

If you have any questions or comments about this advisory, email Electron at security@electronjs.org