CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can…

published March 23, 2018

CVSS
—
EPSS
5%
Percentile
92.3
In the wild
Unconfirmed
What it is

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05082 · 92.3th percentile
Published
2018-03-23T19:00Z
EPSS history
Timeline
  • 23 MAR 19:00Z
    Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can…
    cvelistv5