CVE-2016-1202 High severity vulnerability that affects electron
Local attackers can execute arbitrary code and escalate privileges by placing a malicious Node.js module in a parent directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1202?
CVE-2016-1202 is a high-severity code injection vulnerability in n/a, published on 25 Apr 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Which versions are affected by CVE-2016-1202?
2 open source packages ship an affected version, including electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | All versions | 0.33.5 |
electron npm | All versions | 0.33.5 |
Products include Atom Electron.
How do I fix CVE-2016-1202?
Upgrade electron to 0.33.5 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2016-1202 being exploited?
There is no known exploitation of CVE-2016-1202 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gvcj-pfq2-wxj7.