{"answers":{"affected":"8 open source packages ship an affected version, including electron. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15685 exists.","fix":"Upgrade electron to a fixed version for your release line: 1.7.16, 1.8.8, 2.0.8 or 3.0.0-beta.7.","what":"CVE-2018-15685 is a high-severity code injection vulnerability in Electronjs Electron, published on 23 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-15685 and fix it if it is affected.\n\nWhat it is: CVE-2018-15685 is a high-severity code injection vulnerability in Electronjs Electron, published on 23 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15685 exists.\n\nAffected packages and fixed versions:\n- electron (npm): affected from 1.7.0; fixed in 1.7.16\n- electron (npm): affected from 1.7.0; fixed in 1.7.16\n- electron (npm): affected from 1.8.0; fixed in 1.8.8\n- electron (npm): affected from 1.8.0; fixed in 1.8.8\n- electron (npm): affected from 2.0.0; fixed in 2.0.8\n- electron (npm): affected from 2.0.0; fixed in 2.0.8\n- electron (npm): affected from 3.0.0-beta.1; fixed in 3.0.0-beta.7\n- electron (npm): affected from 3.0.0-beta.1; fixed in 3.0.0-beta.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-15685/ (Markdown: https://insights.sbomify.com/CVE-2018-15685/index.md)","id":"CVE-2018-15685","markdown":"https://insights.sbomify.com/CVE-2018-15685/index.md","name":"CVE-2018-15685","record":{"aliases":["GHSA-hv9c-qwqg-qj3v"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Electron framework","requires_auth":"none","summary":"Attackers can achieve remote code execution in Electron apps using IFRAMEs when nativeWindowOpen or sandbox options are enabled.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"electron","vendor":"electronjs"}],"cvss":{"score":8.1,"severity":"high","source":"nvd","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-1188","name":"Initialization of a Resource with an Insecure Default"}],"description":"GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and \"nativeWindowOpen: true\" or \"sandbox: true\" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.","ecosystems":["npm"],"exploits":{"exploitdb":1,"first_seen":"2018-08-27","github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[{"date":"2018-08-27","kind":"exploitdb","ref":"45272","stars":null,"title":"Electron WebPreferences - Remote Code Execution"}],"tier":"weaponised"},"has_fix":true,"headline":"Electron webPreferences vulnerability can be used to perform remote code execution","id":"CVE-2018-15685","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":"electronjs:electron","products":["electronjs:electron"],"type":"code_injection","year":"2018"},"n_packages":8,"n_references":2,"next":{"headline":"systemd: reexec state injection: fgets() on overlong lines leads to line splitting","id":"CVE-2018-15686"},"packages":[{"ecosystem":"npm","fixed":["1.7.16"],"introduced":["1.7.0"],"last_affected":[],"package":"electron","purl":null,"source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["1.7.16"],"introduced":["1.7.0"],"last_affected":[],"package":"electron","purl":"pkg:npm/electron","source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["1.8.8"],"introduced":["1.8.0"],"last_affected":[],"package":"electron","purl":null,"source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["1.8.8"],"introduced":["1.8.0"],"last_affected":[],"package":"electron","purl":"pkg:npm/electron","source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["2.0.8"],"introduced":["2.0.0"],"last_affected":[],"package":"electron","purl":null,"source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["2.0.8"],"introduced":["2.0.0"],"last_affected":[],"package":"electron","purl":"pkg:npm/electron","source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["3.0.0-beta.7"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"electron","purl":null,"source":"GHSA-hv9c-qwqg-qj3v"},{"ecosystem":"npm","fixed":["3.0.0-beta.7"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"electron","purl":"pkg:npm/electron","source":"GHSA-hv9c-qwqg-qj3v"}],"prev":{"headline":"Information disclosure in n/a","id":"CVE-2018-15684"},"products":["n/a"],"published":"2018-08-23","related":[{"cvss_score":9.8,"headline":"Chromium Remote Code Execution in electron","id":"CVE-2017-16151","kev_date_added":null,"published":"2018-06-07"},{"cvss_score":8.8,"headline":"Electron protocol handler browser vulnerable to Command Injection","id":"CVE-2018-1000118","kev_date_added":null,"published":"2018-03-07"},{"cvss_score":8.4,"headline":"Electron: Context Isolation bypass via contextBridge VideoFrame transfer","id":"CVE-2026-34780","kev_date_added":null,"published":"2026-04-04"},{"cvss_score":8.3,"headline":"Electron: \u003cwebview\u003e can enable Node.js integration in Web Workers despite embedder restrictions","id":"CVE-2026-102676","kev_date_added":null,"published":"2026-09-29"},{"cvss_score":8.2,"headline":"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab","id":"CVE-2026-102673","kev_date_added":null,"published":"2026-09-29"},{"cvss_score":8.2,"headline":"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions","id":"CVE-2026-102674","kev_date_added":null,"published":"2026-09-29"},{"cvss_score":8.1,"headline":"Electron: Use-after-free in offscreen child window paint callback","id":"CVE-2026-34774","kev_date_added":null,"published":"2026-04-03"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["n/a"]},"summary":"Attackers can achieve remote code execution in Electron apps using IFRAMEs when nativeWindowOpen or sandbox options are enabled.","url":"https://insights.sbomify.com/CVE-2018-15685/"}