CVE-2018-1000006

PoC —

CVSS 3.0

8.8 high

EPSS

85%p100

Published

Jan 24, 2018 (Jan 24, 2018)

Modified

Jun 17, 2026

Description

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.

Vendors: atom
Products: electron
Weakness: CWE-78
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (84.5%)

In the news4 stories

Electron Windows Protocol Handler MITM/RCE (bypass for CVE-2018

Security AffairsMay 25, 12:15 UTC · May 25, 2018Vulnerability CVE-2018-1000006

Critical code execution flaw in Electron framework impacts popular Desktop apps such as Skype and Signal

Security AffairsJan 24, 21:15 UTC · Jan 24, 2018Vulnerability CVE-2018-1000006

Critical Flaw Hits Popular Windows Apps Built With Electron JS Framework

The Hacker NewsJan 24, 12:26 UTC · Jan 24, 2018Vulnerability CVE-2018-1000006

Severe Electron framework vulnerability impacts apps like Skype and Slack

CyberScoopJan 23, 20:38 UTC · Jan 23, 2018Vulnerability in the wildCVE-2018-1000006