CVE-2018-1000136: electronjs electron Improper Input Validation
Vulnerability summary
CVE-2018-1000136 is a high (CVSS 8.1) Improper Input Validation vulnerability in electronjs electron. EPSS estimates a 5.08% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-03-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.08%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.08% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (trustwave.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Electronjs1 product
- electronEOL≥ 1.7.0, ≤ 1.7.12 | > 1.8.0, ≤ 1.8.3 | 2.0.0 | 2.0.0:beta1 | 2.0.0:beta2 | 2.0.0:beta3 | 2.0.0:beta4
Npm1 product
- electron≥ 1.7.0, < 1.7.13 | ≥ 1.8.0, < 1.8.4 | ≥ 2.0.0-beta.1, < 2.0.0-beta.5
2 vendors · 2 products
References
11 links- www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/X Refsource MISCExploitThird Party Advisory
- github.com/electron/electronPACKAGE