CVE-2017-16151: Code Injection
First published: Thu Apr 26 2018(Updated: )
Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled. ## Recommendation Update to electron version 1.7.8 or later.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/electron | >=1.7.0<1.7.8 | 1.7.8 |
| npm/electron | <1.6.14 | 1.6.14 |
| Electronjs Electron | <1.7.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-16151
- https://electronjs.org/blog/chromium-rce-vulnerability
- https://github.com/advisories/GHSA-4w88-rjj3-x7wp (Advisory)
- https://www.npmjs.com/advisories/539
- https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
- https://nodesecurity.io/advisories/539
Frequently Asked Questions
What is CVE-2017-16151?
CVE-2017-16151 is a remote code execution vulnerability in Google Chromium that affects all recent versions of Electron.
How severe is CVE-2017-16151?
CVE-2017-16151 has a severity rating of 9.8, which is considered critical.
Which versions of Electron are affected by CVE-2017-16151?
Versions of Electron between 1.7.0 to 1.7.8, versions up to 1.6.14, and versions up to 1.7.8 with the Node.js platform are affected by CVE-2017-16151.
How can I fix CVE-2017-16151?
To fix CVE-2017-16151, update Electron to version 1.7.8 or later.
Where can I find more information about CVE-2017-16151?
You can find more information about CVE-2017-16151 on the NVD (National Vulnerability Database) website, ElectronJS blog, and GitHub.
- collector/github-advisory-latest
- alias/GHSA-4w88-rjj3-x7wp
- alias/CVE-2017-16151
- collector/nvd-index
- collector/nvd-cve
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/npm
- vendor/electronjs
- canonical/electronjs electron