CVE-2016-1202

HIGH7.8EPSS 0.06%

High severity vulnerability that affects electron

Published: 10/24/2017Modified: 11/8/2023

Description

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.

Affected packages (1)

npm/electronfrom 0, < 0.33.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (7)

ADVISORYhttps://github.com/advisories/GHSA-gvcj-pfq2-wxj7
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1202
PATCHhttps://github.com/electron/electron
WEBhttp://jvndb.jvn.jp/jvndb/JVNDB-2016-000054
WEBhttp://jvn.jp/en/jp/JVN00324715/index.html
WEBhttps://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d
WEBhttps://github.com/electron/electron/pull/2976