CVE-2017-16151 Chromium Remote Code Execution in electron

Critical 9.8 Published 7 Jun 2018 Updated 16 Sep 2024

Remote attackers can execute arbitrary code in Electron applications by exploiting a Chromium vulnerability when accessing remote content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-16151?

CVE-2017-16151 is a critical code injection vulnerability in Electronjs Electron, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.

Weakness: CWE-94

Which versions are affected by CVE-2017-16151?

4 open source packages ship an affected version, including electron. It affects 1 product.

Package	Affected	Fixed in
`electron` npm	All versions	`1.6.14`
`electron` npm	All versions	`1.6.14`
`electron` npm	From `1.7.0`	`1.7.8`
`electron` npm	From `1.7.0`	`1.7.8`

Products include Electronjs Electron.

How do I fix CVE-2017-16151?

Upgrade electron to a fixed version for your release line: 1.6.14 or 1.7.8.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-16151 being exploited?

There is no known exploitation of CVE-2017-16151 in the wild and no public exploit code.

All Electronjs Electron vulnerabilities

Sources

Also known as GHSA-4w88-rjj3-x7wp.