Packages / electron / Security

CriticalVulnerabilityGHSA-4w88-rjj3-x7wpCVE-2017-16151Published 24 Jul 2018

Chromium Remote Code Execution in electron

Affected releases · electron

  • 1.x1.3.1 – 1.7.7Fixed in 1.7.8
  • 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated

On 1.x, the newest line:

npm install electron@1.7.8
45.x

  1. Not affected

    45.0.0

    1 release, latest

1.x

  1. Affected

    1.3.1 – 1.6.13

    48 releases

  2. Fixed

    1.6.14 – 1.6.18

    5 releases

  3. Affected

    1.7.0 – 1.7.7

    8 releases

  4. Fixed

    1.7.8 – 1.8.8

    18 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled.

Recommendation

Update to electron version 1.7.8 or later.