CVE-2017-16151

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the sandbox option is enabl...

CVE-2017-16151

CVE-2017-16151 describes a remote code execution vulnerability in Google Chromium that affects Electron apps. The issue, affecting all recent Electron versions when loading remote content, can be triggered regardless of the sandbox option being enabled. The exposed component is Electron’s integra...

electron-packager Man-in-the-Middle Attack Vulnerability

electron-packager is a tool for packaging applications into executables based on different platforms. A security vulnerability exists in electron-packager versions 5.2.1 through 6.0.0 and 6.0.0 through 6.0.2, which stems from the '--strict-ssl' command line option being set by default to 'false '...

Empire GUI - Empire Client Application

The Empire Multiuser GUI is a graphical interface to the Empire post-exploitation Framework. It was written in Electron and utilizes websockets SocketIO on the backend to support multiuser interaction. The main goal of this project is to enable red teams, or any other color team, to work together...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

Command injection

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

CVE-2016-10534

CVE-2016-10534 affects electron-packager where the --strict-ssl option is defaulted to false in versions 5.2.1–6.0.0 and 6.0.0–6.0.2 unless explicitly set to true. This enables potential MITM attacks during Electron downloads for supported targets. Connected advisories corroborate the MITM risk a...

CVE-2016-10534

electron-packager is a command line tool that packages Electron source code into .app and .exe packages. along with Electron. The --strict-ssl command line option in electron-packager = 5.2.1 =6.0.0 = 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a...

Electron NodeIntegration Remote Code Execution (CVE-2018-1000136)

A remote code execution vulnerability exists in Electron. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Simple bug could lead to RCE flaw on apps built with Electron Framework

A critical remote code execution vulnerability has been discovered in the popular Electron web application framework that could allow attackers to execute malicious code on victims' computers. Electron is an open source app development framework that powers thousands of widely-used desktop...

Simple bug could lead to RCE flaw on apps built with Electron Framework

A critical remote code execution vulnerability has been discovered in the popular Electron web application framework that could allow attackers to execute malicious code on victims' computers. Electron is an open source app development framework that powers thousands of widely-used desktop...

Severe Bug Discovered in Signal Messaging App for Windows and Linux

Security researchers have discovered a severe vulnerability in the popular end-to-end encrypted Signal messaging app for Windows and Linux desktops which could allow remote attackers to execute malicious code on recipients system just by sending a message—without requiring any user interaction...

Code Execution by Re-enabling Node.js integration

Overview A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows executi...

GitHub Electron Webviews Command Execution Vulnerability

GitHub Electron formerly known as Atom Shell is the United States GitHub company is responsible for maintaining a set of Web-based cross-platform desktop application development tools. webviews is one of the Web view interface. A security vulnerability exists in Webviews in GitHub Electron versio...

Electron protocol handler browser vulnerable to Command Injection

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...

GHSA-FJQR-FX3F-G4RV Electron protocol handler browser vulnerable to Command Injection

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...

@felixrieseberg/electron-prebuilt-compile (>=2.0.0-beta.1 <=2.0.0-beta.4), electron-prebuilt-compile (>=2.0.0-beta.1 <=2.0.0-beta.4) potentially affected by CVE-2018-1000136 via electron (>=2.0.0-beta.1 <=2.0.0-beta.4)

electron NPM version =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.4 Source cves: CVE-2018-1000136 Source advisory: OSV:GHSA-8XWG-WV7V-4VQP...

@quarks/bpmn-extension (=1.0.0), @quarks/contract-extension (>=1.0.0 <=1.0.6) +45 more potentially affected by CVE-2018-1000136 via electron (>=1.7.0 <=1.7.12)

electron NPM version =1.7.0, =1.0.0, =1.0.1, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0cc6469e, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0cc6469e,...

@devpodio/application-manager (>=0.3.16 <=0.3.20), @devpodio/bunyan (>=0.3.16 <=0.3.20) +148 more potentially affected by CVE-2018-1000136 via electron (>=1.8.1 <=1.8.3)

electron NPM version =1.8.1, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.20 and more Source cves: CVE-2018-1000136 Source advisory: OSV:GHSA-8XWG-WV7V-4VQP...