CVE-2018-1000136
1 advisory.
npm/electron CVE-2018-1000136: high 8.1, EPSS 5.08%
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
Action: Upgrade electron to 1.7.13 or later.
npm i electron@1.7.13npm i electron@1.8.4npm i electron@2.0.0-beta.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.7.0 | 1.7.13 | - |
| 1.8.0 | 1.8.4 | - |
| 2.0.0-beta.1 | 2.0.0-beta.5 | - |
Fixed versions
| 1.7.13 | 1.8.4 | 2.0.0-beta.5 |
Sources
- osv: GHSA-8xwg-wv7v-4vqp
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000136
- https://github.com/electron/electron/pull/12271
- https://github.com/electron/electron/pull/12292
- https://github.com/electron/electron/pull/12294
- https://github.com/electron/electron/commit/1a48ee28276e6588dbf4e70e58d78e7bfdc57043
- https://electronjs.org/blog/webview-fix
- https://github.com/electron/electron
- https://www.electronjs.org/blog/webview-fix
- https://www.npmjs.com/advisories/574
- https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass
CVE-2018-1000136 · published · modified · JSON