Local code execution via attacker-controlled working directory

Code injection in Electron allows local users to execute out-of-package code when a command-line app starts from a writable directory. The upstream advisory does not disclose the startup lookup or file type that causes code outside the application package to load, but it states that ASAR Integrity can be bypassed. Exploitation requires a user to launch the app with an attacker-controlled working directory to which the attacker can write, and the injected code runs in the app's context.