{"id":"CVE-2017-12581","aliases":["EUVD-2022-2989","GHSA-7fv9-m79r-j9x8"],"status":"published","title":"Electron vulnerable to remote command execution","description":"GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06693,"percentile":0.9395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2017-08-06T02:00:00Z","modified":"2026-06-17T01:03:32Z","fixes":[{"ecosystem":"npm","package":"electron","fixed_in":["1.6.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.8"}]}]}],"products":[{"vendor":"electron","product":"electron"}],"references":[{"url":"https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","web"]},{"url":"https://blog.doyensec.com/2017/08/03/electron-framework-security.html","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12581","tags":["advisory"]},{"url":"https://github.com/electron/electron/commit/05b6d91bf4c1e0ee65eeef70cd5d1bd1df125644","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fv9-m79r-j9x8"},{"url":"https://github.com/electron/electron","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-12581","description":"GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.","status":"published","published":"2017-08-06T02:00:00Z","modified":"2024-08-05T18:43:56.211Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2022-2989","description":"GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.","status":"published","published":"2017-08-06T02:00:00Z","modified":"2024-08-05T18:43:56Z","updated_at":"2026-11-03T02:23:20.716903Z"}],"ghsa":[{"id":"GHSA-7fv9-m79r-j9x8","title":"Electron vulnerable to remote command execution","description":"Electron before 1.6.8 allows remote command execution because of a `nodeIntegration` bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a `chrome-devtools://devtools/bundled/inspector.html` window could be used to eval a Node.js `child_process.execFile` API call.","status":"published","published":"2022-05-17T02:14:12Z","modified":"2023-10-19T18:37:42Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2017-12581","description":"GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.","status":"published","published":"2017-08-06T02:29:00.227Z","modified":"2026-06-17T01:03:32.557Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:03:57.282351Z"}],"osv":[{"id":"GHSA-7fv9-m79r-j9x8","title":"Electron vulnerable to remote command execution","description":"Electron before 1.6.8 allows remote command execution because of a `nodeIntegration` bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a `chrome-devtools://devtools/bundled/inspector.html` window could be used to eval a Node.js `child_process.execFile` API call.","status":"published","published":"2022-05-17T02:14:12Z","modified":"2023-11-08T03:58:52.151779Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}