CVE-2018-1000136

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1000136
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000136.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1000136
Aliases
Published
2018-03-23T19:29:00.683Z
Modified
2026-07-08T05:51:57.682301437Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:electronjs:electron:2.0.0:beta1:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:2.0.0:beta2:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:2.0.0:beta3:*:*:*:*:*:*",
                "cpe:2.3:a:electronjs:electron:2.0.0:beta4:*:*:*:*:*:*"
            ],
            "vendor_product": "electronjs:electron",
            "extracted_events": [
                {
                    "introduced": "2.0.0-beta1"
                },
                {
                    "last_affected": "2.0.0-beta1"
                },
                {
                    "introduced": "2.0.0-beta2"
                },
                {
                    "last_affected": "2.0.0-beta2"
                },
                {
                    "introduced": "2.0.0-beta3"
                },
                {
                    "last_affected": "2.0.0-beta3"
                },
                {
                    "introduced": "2.0.0-beta4"
                },
                {
                    "last_affected": "2.0.0-beta4"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/electron/electron

Affected ranges

Type
GIT
Repo
https://github.com/electron/electron
Events
Introduced
b6319698f12f6f0d8095da7a0528b4a3b9949834
Last affected
924e372def4a71e3568804a6a3e7604b205a83fc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1ddf6188f4389642dcd1c3a26c945fcbe6add1a6
Introduced
6b90807cb8f3fd97cb4a20ac8c4407e219c564af
Last affected
6b90807cb8f3fd97cb4a20ac8c4407e219c564af
Database specific 
{
    "cpe": [
        "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:electronjs:electron:2.0.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "1.7.0"
        },
        {
            "last_affected": "1.7.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.8.3"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ]
}

Affected versions

2.*
2.0.0
v1.*
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.2-beta.1
v1.8.2-beta.2
v1.8.2-beta.3
v1.8.2-beta.4
v1.8.2-beta.5
v1.8.3
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000136.json"