mirror of
https://github.com/ElectronNET/Electron.NET.git
synced 2026-02-04 05:34:51 +00:00
Remove the vulnerability CVE-2020-36048 from engine.io use in socket.io? #742
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @KristinaPlusPlus on GitHub (Dec 20, 2021).
Originally assigned to: @GregorBiswanger on GitHub.
Issue:
The electron host relies on socket.io which uses engine.io and although a custom package file could be passed, the code seems to fail when socket.io 3.x and 4.x used. However, using socket.io 2.x is a security vulnerability as it using engine.io ~3.5.0 which exposes vulnerability CVE-2020-36048. There has been an issue placed against socket.io (https://github.com/socketio/socket.io/issues/4047) but it seems it will only be resolved in socket.io 3.x and later.