Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

GitHub Electron: Remote Code Execution Through IFRAME Elements

CVE-2018-15685 · published 8 years ago
Summary

Old versions of GitHub Electron can be tricked into running malicious code from within an IFRAME element. This could allow an attacker to take control of your computer. Update to the latest version of Electron to fix this issue.

What to do
  • Update electron-nightly electron to version 1.7.16.
  • Update electron-nightly electron to version 1.8.8.
  • Update electron-nightly electron to version 2.0.8.
  • Update electron-nightly electron to version 3.0.0-beta.7.
Affected software
Ecosystem VendorProductAffected versions
npm electron-nightly electron >= 1.7.0, < 1.7.16
>= 1.8.0, < 1.8.8
>= 2.0.0, < 2.0.8
>= 3.0.0-beta.1, < 3.0.0-beta.7
Fix: upgrade to 1.7.16
– electronjs electron 1.7.15
1.8.7
2.0.7
3.0.0
cpe:2.3:a:electronjs:electron:1.7.15:*:*:*:*:*:*:*
Original advisory text
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulne...
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
10% chance of attack within 30 days
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published23 Aug 2018
Updated28 Oct 2026
First seen6 Mar 2026
Sources
GHSA-hv9c-qwqg-qj3v · GHSA
CVE-2018-15685 · NVD
Track software like this
Free during beta