CVE-2018-1000136
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
- Affected products
- Electron
- Electronjs Electron
- ≤ 1.7.12, 1.8.3, 2.0.0
- Fix
- Available
- CVSS 3.0
- 8.1 HIGH
- EPSS
- 5.2% (92th percentile)
- Weakness
- CWE-20
- NVD status
- Modified
- Published
- 2018-03-23
CVE-2018-1000136 at NVD
No indexed exploits for CVE-2018-1000136 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2018-1000136 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.