Description

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Remediation

References

https://www.electronjs.org/blog/webview-fix

https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/

Related Vulnerabilities

CVE-2022-29166 Vulnerability in npm package matrix-org-irc

CVE-2021-21350 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2023-25158 Vulnerability in maven package org.geotools:gt-main

CVE-2023-27898 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2023-46133 Vulnerability in npm package crypto-es

Severity

Critical

Classification

CWE-20 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mitigation Patch Vendor Advisory Exploit Third Party Advisory