Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm

GHSA-w222-53c6-c86p

HIGH

Remote Code Execution in electron

Also known asCVE-2018-1000006
Published
Jan 23, 2018
Updated
Nov 8, 2023
Affected
3 pkgs
Patched
3 / 3
Exploits
9 known

EPSS Exploitation Probability

via FIRST.org ↗
92.3%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
91.8%92.2%92.5%92.9%92.3%92.3%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

3 pkgs affected
📦electron📦electron📦electron

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

Affected versions of electron may be susceptible to a remote code execution flaw when certain conditions are met:

  1. The electron application is running on Windows.
  2. The electron application registers as the default handler for a protocol, such as nodeapp://.

This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.

MacOS and Linux are not vulnerable.

Recommendation

Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:

If for some reason you are unable to upgrade your Electron version, you can append -- as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options. The double dash -- signifies the end of command options, after which only positional parameters are accepted.

app.setAsDefaultProtocolClient(protocol, process.execPath, [
  '--your-switches-here',
  '--'
])

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
📦npmelectron≥ 1.7.0&&< 1.7.111.7.11
📦npmelectron≥ 1.6.0&&< 1.6.161.6.16
📦npmelectron≥ 1.8.0&&< 1.8.2-beta.41.8.2-beta.4
Exploits & PoCs
9

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-43899remotewindows

Exodus Wallet (ElectronJS Framework) - Remote Code Execution

by Wflki · Jan 25, 2018

Exploit-DB Source
EDB-44357remotewindows✓ Verified

Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)

by Metasploit · Mar 29, 2018

Exploit-DB Source

Frequently Asked Questions

Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met: 1. The electron application is running on Windows. 2. The electron application registers as the default handler for a protocol, such as `nodeapp://`. This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron. MacOS and Linux are not vulnerable. ## Recommendation Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance: If for
O3 Security · Impact-Aware SCA

Is GHSA-w222-53c6-c86p in your stack?

O3 detects GHSA-w222-53c6-c86p across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works