CVE-2018-1000118: Command Injection in Electron Protocol Handler
Summary
CVE-2018-1000118: Electron protocol handler browser vulnerable to Command Injection. Affects electron versions < 1.8.2-beta5. Fixed in 1.8.2-beta5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. The Electron protocol handler is responsible for handling custom protocols within Electron applications. This vulnerability in Electron's protocol handler allows an attacker to execute arbitrary commands on the victim's system.
Vulnerability Detail
The vulnerability in Electron's protocol handler arises from a command injection flaw. Specifically, Electron versions 1.8.2-beta.4 and earlier are affected. When a victim opens an Electron protocol handler in their browser, an attacker can exploit this vulnerability to execute arbitrary commands on the victim's system. This can lead to various malicious activities, such as unauthorized access, data theft, or system compromise. The vulnerability was initially reported as CVE-2018-1000006, but an incomplete fix allowed attackers to potentially bypass the blacklisting mechanism.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.2-beta5
This is the first release that contains the fix.
npm install electron@1.8.2-beta5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Electron to the fixed version as soon as possible.
Conclusion
The command injection vulnerability in Electron's protocol handler (CVE-2018-1000118) allows attackers to execute arbitrary commands on the victim's system. It is crucial for developers to update their Electron applications to the fixed version (1.8.2-beta.5 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Electron is an open-source framework for building cross-platform desktop applications using web technologies.
The Electron protocol handler is responsible for handling custom protocols within Electron applications.
This vulnerability allows an attacker to execute arbitrary commands on the victim's system by exploiting the Electron protocol handler.
The impact of this vulnerability can range from unauthorized access to complete system compromise, depending on the attacker's intentions.
To protect your Electron application, it is essential to update to the fixed version (1.8.2-beta.5 or later) of Electron.
Related vulnerabilities
Recent vulnerabilities recorded for electron.
