GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving…
Priority MEDIUM 48CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.
Why it matters now
EPSS 0.10297 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed electron (npm): 1.7.16, 1.8.8, 2.0.8 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | electron (npm) | 1.7.0 to before 1.7.16 | 1.7.16 | Patch available | GHSA-hv9c-qwqg-qj3v |
| — | electron (npm) | 1.8.0 to before 1.8.8 | 1.8.8 | Patch available | GHSA-hv9c-qwqg-qj3v |
| — | electron (npm) | 2.0.0 to before 2.0.8 | 2.0.8 | Patch available | GHSA-hv9c-qwqg-qj3v |
| — | electron (npm) | 3.0.0-beta.1 to before 3.0.0-beta.7 | 3.0.0-beta.7 | Patch available | GHSA-hv9c-qwqg-qj3v |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- electron (npm) Vendor— Affected 1.7.0 to before 1.7.16 Fixed in 1.7.16 Patch available GHSA-hv9c-qwqg-qj3v
- electron (npm) Vendor— Affected 1.8.0 to before 1.8.8 Fixed in 1.8.8 Patch available GHSA-hv9c-qwqg-qj3v
- electron (npm) Vendor— Affected 2.0.0 to before 2.0.8 Fixed in 2.0.8 Patch available GHSA-hv9c-qwqg-qj3v
- electron (npm) Vendor— Affected 3.0.0-beta.1 to before 3.0.0-beta.7 Fixed in 3.0.0-beta.7 Patch available GHSA-hv9c-qwqg-qj3v
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:electronjs:electron:1.7.15:*:*:*:*:*:*:* | 1.7.15 | Vulnerable | Electronjs |
| cpe:2.3:a:electronjs:electron:1.8.7:*:*:*:*:*:*:* | 1.8.7 | Vulnerable | Electronjs |
| cpe:2.3:a:electronjs:electron:2.0.7:*:*:*:*:*:*:* | 2.0.7 | Vulnerable | Electronjs |
| cpe:2.3:a:electronjs:electron:3.0.0:beta6:*:*:*:*:*:* | 3.0.0 beta6 | Vulnerable | Electronjs |
- cpe:2.3:a:electronjs:electron:1.7.15:*:*:*:*:*:*:* Versions 1.7.15 Vulnerable ·Electronjs
- cpe:2.3:a:electronjs:electron:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·Electronjs
- cpe:2.3:a:electronjs:electron:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Electronjs
- cpe:2.3:a:electronjs:electron:3.0.0:beta6:*:*:*:*:*:* Versions 3.0.0 beta6 Vulnerable ·Electronjs
Remediation
- Fix · GHSA-hv9c-qwqg-qj3v electron (npm) Fixed in 1.7.16 Advisory →
- Fix · GHSA-hv9c-qwqg-qj3v electron (npm) Fixed in 1.8.8 Advisory →
- Fix · GHSA-hv9c-qwqg-qj3v electron (npm) Fixed in 2.0.8 Advisory →
- Fix · GHSA-hv9c-qwqg-qj3v electron (npm) Fixed in 3.0.0-beta.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-15685
- 2026-10-03 Alias added: GHSA-hv9c-qwqg-qj3v
References
Exploit 1
Advisory 2
Other 8
- https://github.com/electron/electron/commit/519a02d8d4d28e8a467acb40fb26172a80c9454f
- https://github.com/electron/electron/commit/80221e52d93a96ea704cb6748ead669c55cff504
- https://github.com/electron/electron/commit/bab968ca776be28791e4dddfd50c86bd5fae62fa
- https://github.com/electron/electron/commit/ef0a6d9a1c96efc4657c6dd3a6624eba969f095b
- https://github.com/electron/electron
- https://www.contrastsecurity.com/security-influencers/cve-2018-15685
- https://www.exploit-db.com/exploits/45272
- https://www.npmjs.com/advisories/732
More Electronjs Electron vulnerabilities
- TI-2023-09452 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron CVSS 3.1CRITICAL 9.8
- TI-2017-11870 Code injection in HackerOne electron node module CVSS 3.0CRITICAL 9.8
- TI-2022-11788 Exposure of Resource to Wrong Sphere in Electron CVSS 3.1CRITICAL 9.8
- TI-2020-03557 Context isolation bypass via contextBridge in Electron CVSS 3.1CRITICAL 9.9
- TI-2026-65465 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVSS 3.1CRITICAL 9.8
- TI-2026-27019 Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-15685 · CVE Program
- CVE-2018-15685 · NVD
- FIRST EPSS
- GHSA-hv9c-qwqg-qj3v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences