GHSA-4w88-rjj3-x7wp
Chromium Remote Code Execution in electron
At a glance
- Published
- Updated
- CVE
- CVE-2017-16151
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled. ## Recommendation Update to electron version 1.7.8 or later.
Affected packages
| Package | Versions |
|---|---|
| npm · electron | introduced 0, fixed 1.6.14 |
| npm · electron | introduced 1.7.0, fixed 1.7.8 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-16151 ADVISORY
- https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix WEB
- https://electronjs.org/blog/chromium-rce-vulnerability WEB
- https://github.com/advisories/GHSA-4w88-rjj3-x7wp ADVISORY
- https://www.npmjs.com/advisories/539 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |