PT-2018-6178 · Electron+1 · Electronjs+1

Published 2018-06-07 · Updated 2019-10-09 · CVE-2017-16151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ElectronJS versions prior to 1.7.8

Description: A remote code execution issue has been discovered in Google Chromium, affecting recent versions of Electron. This issue occurs when an Electron application accesses remote content, regardless of whether the sandbox option is enabled.

Recommendations: Update to Electron version 1.7.8 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-16151

GHSA-4W88-RJJ3-X7WP

Affected Products

Electronjs

Google Chromium

References · 8

• https://osv.dev/vulnerability/GHSA-4w88-rjj3-x7wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16151 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16151 · Vendor Advisory
• https://nodesecurity.io/advisories/539 · Note
• https://electronjs.org/blog/chromium-rce-vulnerability · Note
• https://github.com/advisories/GHSA-4w88-rjj3-x7wp · Note
• https://npmjs.com/advisories/539 · Note
• https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix · Note