CVE-2017-16151

CRITICAL9.8EPSS 2.7%

Chromium Remote Code Execution in electron

Published: 7/24/2018Modified: 11/8/2023

Description

Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled. ## Recommendation Update to electron version 1.7.8 or later.

Affected packages (1)

npm/electronfrom 0, < 1.6.14

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://github.com/advisories/GHSA-4w88-rjj3-x7wp
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-16151
WEBhttps://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
WEBhttps://electronjs.org/blog/chromium-rce-vulnerability
WEBhttps://www.npmjs.com/advisories/539