{"id":"GHSA-w222-53c6-c86p","summary":"Remote Code Execution in electron","details":"Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met:\n1. The electron application is running on Windows.\n2. The electron application registers as the default handler for a protocol, such as `nodeapp://`.\n\nThis vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.\n\nMacOS and Linux are not vulnerable.\n\n\n## Recommendation\n\nUpdate electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:\n\n\nIf for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted.\n```\napp.setAsDefaultProtocolClient(protocol, process.execPath, [\n  '--your-switches-here',\n  '--'\n])\n```","aliases":["CVE-2018-1000006"],"modified":"2023-11-08T03:59:33.174686Z","published":"2018-01-23T03:57:44Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-06-16T21:59:07Z","nvd_published_at":null,"cwe_ids":["CWE-78"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000006"},{"type":"WEB","url":"https://electronjs.org/blog/protocol-handler-fix"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w222-53c6-c86p"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v1.8.2-beta.4"},{"type":"WEB","url":"https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/43899"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/44357"},{"type":"WEB","url":"https://www.npmjs.com/advisories/563"},{"type":"WEB","url":"http://www.securityfocus.com/bid/102796"}],"affected":[{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-w222-53c6-c86p/GHSA-w222-53c6-c86p.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.16"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-w222-53c6-c86p/GHSA-w222-53c6-c86p.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.8.2-beta.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-w222-53c6-c86p/GHSA-w222-53c6-c86p.json","last_known_affected_version_range":"\u003c= 1.8.2-beta.3"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}