CVE-2018-1000136 | BDVDB-2026-98250 Detail

Description#

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.electronjs.org/blog/webview-fix
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/

Exploit#

No public exploit known

History#

Version 12018-03-23Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.