diff --git a/advisories/github-reviewed/2018/03/GHSA-8xwg-wv7v-4vqp/GHSA-8xwg-wv7v-4vqp.json b/advisories/github-reviewed/2018/03/GHSA-8xwg-wv7v-4vqp/GHSA-8xwg-wv7v-4vqp.json index 135cdb719fc..6926890c3ca 100644 --- a/advisories/github-reviewed/2018/03/GHSA-8xwg-wv7v-4vqp/GHSA-8xwg-wv7v-4vqp.json +++ b/advisories/github-reviewed/2018/03/GHSA-8xwg-wv7v-4vqp/GHSA-8xwg-wv7v-4vqp.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8xwg-wv7v-4vqp", - "modified": "2023-03-31T18:21:31Z", + "modified": "2023-09-13T19:06:52Z", "published": "2018-03-26T16:41:17Z", "aliases": [ "CVE-2018-1000136" ], "summary": "Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration", - "details": "Versions of electron \nA vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.\n\nFor the application to be impacted by this vulnerability it must meet all of these conditions\n\n- Runs on Electron 1.7, 1.8, or a 2.0.0-beta\n- Allows execution of arbitrary remote code\n- Disables Node.js integration\n- Does not explicitly declare webviewTag: false in its webPreferences\n- Does not enable the nativeWindowOption option\n- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag\n\n\n## Recommendation\n\nUpdate to `electron` version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later.\n\nIf you are unable to update your Electron version can mitigate the vulnerability with the following code.\n\n```\napp.on('web-contents-created', (event, win) => {\n win.on('new-window', (event, newURL, frameName, disposition,\n options, additionalFeatures) => {\n if (!options.webPreferences) options.webPreferences = {};\n options.webPreferences.nodeIntegration = false;\n options.webPreferences.nodeIntegrationInWorker = false;\n options.webPreferences.webviewTag = false;\n delete options.webPreferences.preload;\n })\n})\n\n// and *IF* you don't use WebViews at all,\n// you might also want\napp.on('web-contents-created', (event, win) => {\n win.on('will-attach-webview', (event, webPreferences, params) => {\n event.preventDefault();\n })\n})\n```", + "details": "A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.\n\nFor the application to be impacted by this vulnerability it must meet all of these conditions\n\n- Runs on Electron 1.7, 1.8, or a 2.0.0-beta\n- Allows execution of arbitrary remote code\n- Disables Node.js integration\n- Does not explicitly declare webviewTag: false in its webPreferences\n- Does not enable the nativeWindowOption option\n- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag\n\n\n## Recommendation\n\nUpdate to `electron` version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later.\n\nIf you are unable to update your Electron version can mitigate the vulnerability with the following code.\n\n```js\napp.on('web-contents-created', (event, win) => {\n win.on('new-window', (event, newURL, frameName, disposition,\n options, additionalFeatures) => {\n if (!options.webPreferences) options.webPreferences = {};\n options.webPreferences.nodeIntegration = false;\n options.webPreferences.nodeIntegrationInWorker = false;\n options.webPreferences.webviewTag = false;\n delete options.webPreferences.preload;\n })\n})\n\n// and *IF* you don't use WebViews at all,\n// you might also want\napp.on('web-contents-created', (event, win) => {\n win.on('will-attach-webview', (event, webPreferences, params) => {\n event.preventDefault();\n })\n})\n```", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "electron" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -39,6 +44,11 @@ "ecosystem": "npm", "name": "electron" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -58,6 +68,11 @@ "ecosystem": "npm", "name": "electron" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM",