CVE-2016-1202: Untrusted search path vulnerability in electron
Summary
CVE-2016-1202: High severity vulnerability that affects electron. Affects electron versions < 0.33.5. Fixed in 0.33.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. Electron is widely used by developers to create popular applications like Atom, Slack, and Visual Studio Code. However, Electron versions before 0.33.5 are vulnerable to an untrusted search path vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2016-1202, allows local users to gain privileges by exploiting a Trojan horse Node.js module in a parent directory of a directory named on a require line. This means that an attacker with local access to the system can place a malicious Node.js module in a specific location and trick Electron into loading it, potentially leading to privilege escalation. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code with elevated privileges.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.33.5
This is the first release that contains the fix.
npm install electron@0.33.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is recommended to follow the principle of least privilege and restrict access to sensitive directories and files. Additionally, it is important to regularly update the Electron framework and its dependencies to mitigate potential vulnerabilities.
Conclusion
The untrusted search path vulnerability in Electron versions before 0.33.5 can allow local users to gain privileges and execute arbitrary code with elevated privileges. To mitigate this vulnerability, it is crucial to update Electron to version 0.33.5 or later and ensure that the Electron dependency in the application is updated. Following security best practices and regularly updating dependencies can help prevent potential vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Electron is an open-source framework that enables developers to build cross-platform desktop applications using web technologies.
The vulnerability allows local users to gain privileges, potentially leading to arbitrary code execution with elevated privileges.
To fix the vulnerability, upgrade Electron to version 0.33.5 or later and update the Electron dependency in your application.
While no specific workaround is mentioned, it is recommended to follow security best practices such as restricting access to sensitive directories and regularly updating dependencies.
Applications that use Electron versions before 0.33.5 are affected by this vulnerability. It is recommended to check the Electron version used in your application and update if necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
