CoreCVE
Back

HIGH

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute

Published Mar 7, 2018

Description

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 7, 2018
Updated Sep 16, 2024
Reserved Mar 7, 2018
Link CVE-2018-1000118
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-1000118
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-1000118
ENISA EUVD
Assigner mitre
Published Mar 7, 2018
Updated Sep 16, 2024
Exploited since n/a
Link EUVD-2018-0179
EUVD-2018-0179 GHSA-FJQR-FX3F-G4RV