A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. This vulnerability has been assigned the CVE identifier CVE-2018-1000136.
An application is affected if all of the following are true:
webviewTag: false
in its webPreferencesnativeWindowOption
optionnew-window
events and manually override event.newGuest
without using the supplied options tagAlthough this appears to be a minority of Electron applicatons, we encourage all applications to be upgraded as a precaution.
This vulnerability is fixed in today's 1.7.13, 1.8.4, and 2.0.0-beta.5 releases.
Developers who are unable to upgrade their application's Electron version can mitigate the vulnerability with the following code:
app.on('web-contents-created', (event, win) => {
win.on('new-window', (event, newURL, frameName, disposition,
options, additionalFeatures) => {
if (!options.webPreferences) options.webPreferences = {};
options.webPreferences.nodeIntegration = false;
options.webPreferences.nodeIntegrationInWorker = false;
options.webPreferences.webviewTag = false;
delete options.webPreferences.preload;
})
})
// and *IF* you don't use WebViews at all,
// you might also want
app.on('web-contents-created', (event, win) => {
win.on('will-attach-webview', (event, webPreferences, params) => {
event.preventDefault();
})
})
This vulnerability was found and reported responsibly to the Electron project by Brendan Scarvell of Trustwave SpiderLabs.
To learn more about best practices for keeping your Electron apps secure, see our security tutorial.
To report a vulnerability in Electron, please email security@electronjs.org.
Please join our email list to receive updates about releases and security updates.
Have feedback on this post? Let @electronjs know on Twitter.
Need help or found a bug? Contact us.
Key | Action | |
---|---|---|
/ | Focus the search bar | |
Esc | Focus the search bar and cleans it | |
↓ | Select the next search result | |
↑ | Select the previous search result | |
Enter | Open the selected search result | |
cmdEnter | Ctrl+Enter | Open the selected search result in a new tab |