Packages / electron / Security

HighVulnerabilityGHSA-hv9c-qwqg-qj3vCVE-2018-15685Published 23 Aug 2018

Electron webPreferences vulnerability can be used to perform remote code execution

Affected releases · electron

  • 2.x2.0.0 – 2.0.7Fixed in 2.0.8
  • 1.x1.7.0 – 1.8.7Fixed in 1.8.8

On 2.x, the newest line:

npm install electron@2.0.8
45.x

  1. Not affected

    45.0.0

    1 release, latest

2.x

  1. Affected

    2.0.0 – 2.0.7

    8 releases

  2. Fixed

    2.0.8 – 2.0.18

    11 releases

1.x

  1. Not affected

    1.3.1 – 1.6.18

    53 releases

  2. Affected

    1.7.0 – 1.7.15

    16 releases

  3. Fixed

    1.7.16

    1 release

  4. Affected

    1.8.0 – 1.8.7

    8 releases

  5. Fixed

    1.8.8

    1 release

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution.

More information to determine if you are impacted can be found on the electron blog.

Recommendation

Upgrade Electron to >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16.