{"id":"CVE-2018-1000006","aliases":["EUVD-2018-0166","GHSA-w222-53c6-c86p"],"status":"published","title":"Remote Code Execution in electron","description":"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.88842,"percentile":0.9978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2018-01-23T03:57:44Z","modified":"2026-10-20T10:50:12Z","exploits":[{"source":"pocgithub","id":"CHYbeta/CVE-2018-1000006-DEMO","title":"CHYbeta/CVE-2018-1000006-DEMO","date":"2018-01-25","url":"https://github.com/CHYbeta/CVE-2018-1000006-DEMO"},{"source":"exploitdb","id":"EDB-43899","title":"Exodus Wallet (ElectronJS Framework) - Remote Code Execution","type":"remote","platform":"windows","date":"2018-01-25","url":"https://www.exploit-db.com/exploits/43899"},{"source":"metasploit","id":"exploit/windows/browser/exodus","title":"Exodus Wallet (ElectronJS Framework) remote Code Execution","type":"exploit","platform":"Windows","date":"2018-01-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/browser/exodus"},{"source":"exploitdb","id":"EDB-44357","title":"Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2018-03-29","verified":true,"url":"https://www.exploit-db.com/exploits/44357"}],"fixes":[{"ecosystem":"npm","package":"electron","fixed_in":["1.7.11","1.6.16","1.8.2-beta.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"last_affected":"1.8.2-beta.3"},{"fixed":"1.8.2-beta.4"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.11"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.16"}]}]},{"source":"osv","ecosystem":"npm","package":"electron","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.8.2-beta.4"}]}]}],"products":[{"vendor":"atom","product":"electron"}],"references":[{"url":"https://www.exploit-db.com/exploits/43899/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://github.com/electron/electron/releases/tag/v1.8.2-beta.4","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://medium.com/%40Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://electronjs.org/blog/protocol-handler-fix","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/102796","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/44357/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000006","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w222-53c6-c86p","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/563","tags":["web"]},{"url":"https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/43899","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/44357","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000006","description":"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.","status":"published","published":"2018-01-24T23:00:00Z","modified":"2024-08-05T12:33:49.215Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-0166","description":"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.","status":"published","published":"2018-01-24T23:00:00Z","modified":"2024-08-05T12:33:49Z","updated_at":"2026-11-03T02:39:26.824954Z"}],"ghsa":[{"id":"GHSA-w222-53c6-c86p","title":"Remote Code Execution in electron","description":"Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met:\n1. The electron application is running on Windows.\n2. The electron application registers as the default handler for a protocol, such as `nodeapp://`.\n\nThis vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.\n\nMacOS and Linux are not vulnerable.\n\n\n## Recommendation\n\nUpdate electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:\n\n\nIf for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted.\n```\napp.setAsDefaultProtocolClient(protocol, process.execPath, [\n  '--your-switches-here',\n  '--'\n])\n```","status":"published","published":"2018-01-23T03:57:44Z","modified":"2023-01-09T05:03:38Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2018-1000006","description":"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.","status":"published","published":"2018-01-24T23:29:00.497Z","modified":"2026-06-17T01:32:11.59Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-1000006","description":"GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.","status":"published","published":"2018-01-24T23:29:00.497Z","modified":"2026-10-20T10:50:12.786588299Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"GHSA-w222-53c6-c86p","title":"Remote Code Execution in electron","description":"Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met:\n1. The electron application is running on Windows.\n2. The electron application registers as the default handler for a protocol, such as `nodeapp://`.\n\nThis vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.\n\nMacOS and Linux are not vulnerable.\n\n\n## Recommendation\n\nUpdate electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:\n\n\nIf for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted.\n```\napp.setAsDefaultProtocolClient(protocol, process.execPath, [\n  '--your-switches-here',\n  '--'\n])\n```","status":"published","published":"2018-01-23T03:57:44Z","modified":"2023-11-08T03:59:33.174686Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}