CVE-2024-29900

    Dashboard / Vulnerabilities / CVE-2024-29900

    CVE-2024-29900

    Published: 29 Mar 2024Last Modified: 12 Aug 2026

    Summary: @electron/packager's build process memory potentially leaked into final executable

    Details: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29900.json, https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57, https://nvd.nist.gov/vuln/detail/CVE-2024-29900, https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 224cc6a28ddfcf4d1a184a25d10833cf153e3bda
    Fixed -d421d4bd3ced889a4143c5c3ab6d95e3be249eee

    Affected versions

    18.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-29900 | CVE-DB