What is CVE-2018-1000136?

CVE-2018-1000136 is a high-severity vulnerability in Electronjs Electron, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2018-03-23.

How severe is CVE-2018-1000136?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2018-1000136 known to be exploited?

8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Electronjs Electron

CVE-2018-1000136

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Electronjs Electron — versions 2.0.0
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

cve@mitre.org (Patch, x_refsource_MISC, Mitigation, Vendor Advisory)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-1000136?: CVE-2018-1000136 is a high-severity vulnerability in Electronjs Electron, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2018-03-23.
How severe is CVE-2018-1000136?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2018-1000136 known to be exploited?: 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.