GitHub Electron Webviews Command Execution Vulnerability

GitHub Electron formerly known as Atom Shell is the United States GitHub company is responsible for maintaining a set of Web-based cross-platform desktop application development tools. webviews is one of the Web view interface. A security vulnerability exists in Webviews in GitHub Electron versio...

@fdnpm/fd-module-cli (>=4.0.4, <=4.0.7), @finviet-jsrpt/jsrpt-electron-pdf (>=1.0.5, <=1.0.6) +148 more potentially affected by CVE-2018-1000118 via electron (>=1.3.1, <=1.8.1)

electron NPM version =1.3.1, =4.0.4, =1.0.5, =2.1.1, =1.0.0, =0.0.7, =1.3.0, =4.1.0, =0.1.6, =0.6.0, =1.0.1, =1.0.0, =1.0.1, =1.0.2 and more Source cves: CVE-2018-1000118 Source advisory: OSV:GHSA-FJQR-FX3F-G4RV...

GHSA-FJQR-FX3F-G4RV Electron protocol handler browser vulnerable to Command Injection

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...

Electron protocol handler browser vulnerable to Command Injection

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...

GHSA-8XWG-WV7V-4VQP Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows execution of...

@devpodio/application-manager (>=0.3.16, <=0.3.20), @devpodio/bunyan (>=0.3.16, <=0.3.20) +148 more potentially affected by CVE-2018-1000136 via electron (>=1.8.1, <=1.8.3)

electron NPM version =1.8.1, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.20 and more Source cves: CVE-2018-1000136 Source advisory: OSV:GHSA-8XWG-WV7V-4VQP...

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows execution of...

@ftnk/electron-prebuilt-compile (1.7.3), @quarks/bpmn-extension (1.0.0) +67 more potentially affected by CVE-2018-1000136 via electron (>=1.7.0, <=1.7.12)

electron NPM version =1.7.0, =1.0.0, =1.0.1, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.4.0-next.ff386514 and...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

Input validation

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

CVE-2018-1000136

The Electron framework (versions 1.7 to 1.7.12, 1.8 to 1.8.3, and 2.0.0 to 2.0.0-beta.3) contains an improper handling of values vulnerability within Webviews . This flaw can lead to remote code execution (RCE). The vulnerability is particularly relevant for applications that allow third-party co...

CVE-2018-1000136: Improper Input Validation

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node...

PT-2018-9309

Name of the Vulnerable Software and Affected Versions: Electron versions 1.7 up to 1.7.12 Electron versions 1.8 up to 1.8.3 Electron versions 2.0.0 up to 2.0.0-beta.3 Description: The issue is related to an improper handling of values in Webviews, which can result in remote code execution. This c...

Github Electron Protocol Handler Command Injection Vulnerability

GitHub Electron is a GitHub application development framework . The framework supports the use of JavaScript, HTML and CSS to write cross-platform desktop applications . Protocol Handler is one of the protocol handler . A command injection vulnerability exists in Protocol Handler in Github Electr...

Remote Code Execution (RCE)

Electron is vulnerable to remote code execution RCE attacks. A malicious user can pass a Electron Protocol Handler to the application that when clicked on executes arbitrary code. This vulnerability is due to an incomplete fix in CVE-2018-1000006...

Command injection

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...