CVE-2018-1000136: Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
Summary
CVE-2018-1000136: Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration. Affects electron across 3 version ranges.
>= 1.7.0, < 1.7.13
>= 1.8.0, < 1.8.4
>= 2.0.0-beta.1, < 2.0.0-beta.5
Fixed in 1.7.13, 1.8.4 or 2.0.0-beta.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications using web technologies. Electron applications can run on Windows, macOS, and Linux operating systems. This vulnerability affects Electron versions 1.7, 1.8, and 2.0.0-beta. It specifically targets applications that disable Node.js integration but allow the execution of arbitrary remote code.
Vulnerability Detail
The vulnerability allows Node.js integration to be re-enabled in Electron applications that have disabled it. This can lead to code execution vulnerabilities, allowing an attacker to execute arbitrary code on the user's machine. To be impacted by this vulnerability, an Electron application must meet specific conditions, including running on the affected versions, allowing execution of arbitrary remote code, disabling Node.js integration, not explicitly declaring webviewTag as false in webPreferences, not enabling the nativeWindowOption option, and not intercepting new-window events and manually overriding event.newGuest without using the supplied options tag.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.7.0, < 1.7.131.7.13npm install electron@1.7.13 -
>= 1.8.0, < 1.8.41.8.4npm install electron@1.8.4 -
>= 2.0.0-beta.1, < 2.0.0-beta.52.0.0-beta.5npm install electron@2.0.0-beta.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to add the provided code snippet to the Electron application. This code ensures that Node.js integration is disabled and prevents the re-enabling of Node.js integration. If WebViews are not used in the application, an additional code snippet can be added to prevent the attachment of WebViews.
Conclusion
The vulnerability in Electron allows Node.js integration to be re-enabled, leading to code execution vulnerabilities. It is crucial to update to the recommended versions or apply the provided code snippet to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com. Vulert (https://vulert.com) is a platform that monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
See every vulnerability recorded for electron →
FAQ
Versions 1.7, 1.8, and 2.0.0-beta of Electron are affected.
An Electron application must run on the affected versions, allow execution of arbitrary remote code, disable Node.js integration, not explicitly declare webviewTag as false in webPreferences, not enable the nativeWindowOption option, and not intercept new-window events and manually override event.newGuest without using the supplied options tag.
This vulnerability can lead to code execution vulnerabilities, allowing an attacker to execute arbitrary code on the user's machine.
To fix this vulnerability, it is recommended to update to Electron version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later. If updating is not possible, the provided code snippet can be added to mitigate the vulnerability.
Yes, a workaround is to add the provided code snippet to the Electron application to disable Node.js integration and prevent the re-enabling of Node.js integration.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
