CVE-2018-1000006: Remote Code Execution in electron
Summary
CVE-2018-1000006: Remote Code Execution in electron. Affects electron across 3 version ranges.
>= 1.6.0, < 1.6.16
>= 1.7.0, < 1.7.11
>= 1.8.0, < 1.8.2-beta.4
Fixed in 1.6.16, 1.7.11 or 1.8.2-beta.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. However, certain versions of Electron are vulnerable to a remote code execution flaw on Windows when the application registers as the default handler for a specific protocol. This vulnerability arises from a failure to properly sanitize additional arguments to Chromium in the command line handler for Electron. It does not affect macOS and Linux systems.
Vulnerability Detail
The vulnerability in Electron allows an attacker to execute arbitrary code remotely under specific conditions. When an Electron application is running on Windows and registers as the default handler for a protocol, such as nodeapp://, an attacker can exploit this vulnerability. By manipulating the command line arguments passed to Chromium, the attacker can inject malicious code and execute it within the Electron application's context. This can lead to various consequences, including unauthorized access to sensitive data, system compromise, and further exploitation of the host system.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.6.0, < 1.6.161.6.16npm install electron@1.6.16 -
>= 1.7.0, < 1.7.111.7.11npm install electron@1.7.11 -
>= 1.8.0, < 1.8.2-beta.41.8.2-beta.4npm install electron@1.8.2-beta.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade your Electron version, you can apply a workaround by appending -- as the last argument when calling app.setAsDefaultProtocolClient. This prevents Chromium from parsing further options. Here is an example of the workaround code:
app.setAsDefaultProtocolClient(protocol, process.execPath, [
'--your-switches-here',
'--'
])
Conclusion
The vulnerability in Electron allows for remote code execution on Windows systems when the application registers as the default handler for a specific protocol. It is recommended to update Electron to a non-vulnerable version or apply the provided workaround. Failure to address this vulnerability can result in unauthorized code execution, compromising the security and integrity of the affected Electron applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Versions 1.7.0 to 1.7.11, 1.6.0 to 1.6.16, and 1.8.0 to 1.8.2-beta.3 of Electron are affected by this vulnerability.
Yes, this vulnerability only affects Electron applications running on Windows. macOS and Linux systems are not vulnerable.
Exploiting this vulnerability can lead to remote code execution within the Electron application's context. This can result in unauthorized access to sensitive data, system compromise, and further exploitation of the host system.
If updating Electron is not possible, you can apply the workaround by appending -- as the last argument when calling app.setAsDefaultProtocolClient in your application's code.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to address this vulnerability to prevent potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for electron.
