Packages / electron / Security

HighVulnerabilityGHSA-fjqr-fx3f-g4rvCVE-2018-1000118Published 26 Mar 2018

Electron protocol handler browser vulnerable to Command Injection

Affected releases · electron

  • 1.x1.3.1 – 1.8.1Fixed in 1.8.2
  • 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated

On 1.x, the newest line:

npm install electron@1.8.2
45.x

  1. Not affected

    45.0.0

    1 release, latest

1.x

  1. Affected

    1.3.1 – 1.8.1

    72 releases

  2. Fixed

    1.8.2 – 1.8.8

    7 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.