Executive brief
Electron is a framework used to build cross-platform desktop applications. Versions before 1.6.8 contain a vulnerability that allows remote code execution on a user's computer by bypassing security policies and executing system commands. An attacker could exploit this through a malicious website or application to take complete control of the affected system.
Technical details
The vulnerability is a command injection flaw (CWE-78) in Electron's renderer process due to insufficient nodeIntegration security enforcement in chrome-devtools:// URLs. By bypassing the Same Origin Policy (SOP) and accessing privileged internal URLs like chrome-devtools://devtools/bundled/inspector.html, an attacker can invoke Node.js primitives—specifically child_process.execFile—to execute arbitrary OS commands with user privileges. The vulnerability requires network reachability and ability to load a malicious URL, but no authentication is needed and newer Electron versions lack strict SOP enforcement. The fix, applied in version 1.6.8 and later, disables nodeIntegration in chrome-devtools: URLs by setting the nodeIntegration flag to false in the renderer initialization code.
Affected products
- OpenJS Foundation Electron before 1.6.8
Timeline
- 2017-08-06: disclosed
- 2017: patched: Fixed in version 1.6.8
- 2022-05-17: advisory