Packages / electron / Security

HighVulnerabilityGHSA-7fv9-m79r-j9x8CVE-2017-12581Published 17 May 2022

Electron vulnerable to remote command execution

Affected releases · electron

  • 1.x1.3.1 – 1.6.7Fixed in 1.6.8
  • 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated

On 1.x, the newest line:

npm install electron@1.6.8
45.x

  1. Not affected

    45.0.0

    1 release, latest

1.x

  1. Affected

    1.3.1 – 1.6.7

    42 releases

  2. Fixed

    1.6.8 – 1.8.8

    37 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.