CVE-2025-55305
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-04

Last updated on: 2025-09-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-04
Last Modified
2025-09-05
Generated
2026-06-16
AI Q&A
2025-09-05
EPSS Evaluated
2026-06-15
NVD
CVE-2025-55305
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
electron electron *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an ASAR Integrity Bypass in the Electron framework affecting certain versions. It allows modification of resources in apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled, potentially bypassing integrity checks on ASAR archives used by Electron apps.

Impact Analysis

If you use an affected version of Electron with the specified fuses enabled, an attacker could modify application resources, leading to potential integrity violations. This could result in unauthorized code execution or altered app behavior, impacting the security and reliability of your application.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Electron applications are updated to versions 35.7.5, 36.8.1, 37.3.1, or 38.0.0-beta.6 or later. Additionally, verify whether the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled in your apps, as only apps with these fuses enabled are impacted. If possible, disable these fuses or update the app to a fixed version to prevent ASAR integrity bypass via resource modification.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-55305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart