High severity · published Mar 7, 2018
CVE-2018-1000118
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute
8.8
CVSS
2.4%
EPSS
No
On KEV
Description
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Electron · Electronjs
through 1.8.1; 1.8.2; 1.8.2; 1.8.2; 1.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000118
Third Party Advisory
https://electronjs.org/releases#1.8.2-beta.5
Patch
https://github.com/electron/electron/commit/ce361a12e355f9e1e99c989f1ea056c9e502dbe7
More from Electron
9.9
CVE-2020-4077
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.8
CVE-2023-23623
Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron
9.8
CVE-2022-29247
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS