CVSS 3.0
8.1 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-15685
High (8.1) in electronjs electron. EPSS 10% chance of exploitation in the next 30 days. Fixed in electron 1.7.16, 1.8.8, 2.0.8.
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.
Severity
- EPSS
- 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1188
- Published
- Modified
- Record from
- the NVD, synced
Affected
- electronjs:electron
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hv9c-qwqg-qj3v | npm | electron | >=1.7.0 <1.7.16 | 1.7.16 |
| GHSA-hv9c-qwqg-qj3v | npm | electron | >=1.8.0 <1.8.8 | 1.8.8 |
| GHSA-hv9c-qwqg-qj3v | npm | electron | >=2.0.0 <2.0.8 | 2.0.8 |
| GHSA-hv9c-qwqg-qj3v | npm | electron | >=3.0.0-beta.1 <3.0.0-beta.7 | 3.0.0-beta.7 |