CVE-2018-1000118 Electron protocol handler browser vulnerable to Command Injection
An attacker can execute arbitrary commands by tricking a user into opening a malicious Electron protocol handler link in their browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000118?
CVE-2018-1000118 is a high-severity command injection vulnerability in Electronjs Electron, published on 7 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Weakness: CWE-78
Which versions are affected by CVE-2018-1000118?
2 open source packages ship an affected version, including electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | All versions | 1.8.2-beta5 |
electron npm | All versions | 1.8.2-beta5 |
Products include Electronjs Electron.
How do I fix CVE-2018-1000118?
Upgrade electron to 1.8.2-beta5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-1000118 being exploited?
There is no known exploitation of CVE-2018-1000118 in the wild and no public exploit code.
Other vulnerabilities in Electronjs Electron
- CVE-2017-16151 Chromium Remote Code Execution in electron
- CVE-2026-34780 Electron: Context Isolation bypass via contextBridge VideoFrame transfer
- CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Sources
Also known as GHSA-fjqr-fx3f-g4rv.