GHSA-hv9c-qwqg-qj3v

Electron webPreferences vulnerability can be used to perform remote code execution

Source: GitHub Advisory Database (reviewed) High CVE-2018-15685

Packages

Ecosystem	Package	Affected	Fixed in
npm	electron	>= 1.7.0, < 1.7.16	1.7.16
npm	electron	>= 1.8.0, < 1.8.8	1.8.8
npm	electron	>= 2.0.0, < 2.0.8	2.0.8
npm	electron	>= 3.0.0-beta.1, < 3.0.0-beta.7	3.0.0-beta.7

Details

As written in the advisory (Markdown source, shown as plain text).

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a webPreferences vulnerability that can be leveraged to perform remote code execution. More information to determine if you are impacted can be found on the [electron blog](https://electronjs.org/blog/web-preferences-fix). ## Recommendation Upgrade Electron to >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-15685 advisory
https://github.com/electron/electron/commit/519a02d8d4d28e8a467acb40fb26172a80c9454f web
https://github.com/electron/electron/commit/80221e52d93a96ea704cb6748ead669c55cff504 web
https://github.com/electron/electron/commit/bab968ca776be28791e4dddfd50c86bd5fae62fa web
https://github.com/electron/electron/commit/ef0a6d9a1c96efc4657c6dd3a6624eba969f095b web
https://electronjs.org/blog/web-preferences-fix web
https://github.com/electron/electron package
https://www.contrastsecurity.com/security-influencers/cve-2018-15685 web
https://www.exploit-db.com/exploits/45272 web
https://www.npmjs.com/advisories/732 web