atom electron vulnerabilities

Latest atom electron CVEs

Newest publication first

1. CVE-2023-23623 Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

   Published 2023-09-06

   Critical·CVSS 9.8

   Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a script-src directive and not providing unsafe-eval in that directive, is not respected in renderer...

2. CVE-2018-1000006 Remote Code Execution in electron

   Published 2018-01-24

   High·CVSS 8.8 EPSS 88.8% Framework module Public exploit

   GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution...

3. CVE-2017-1000424 Electron vulnerable to URL spoofing via PDFium

   Published 2018-01-02

   Medium·CVSS 4.3

   Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

4. CVE-2016-1202 High severity vulnerability that affects electron

   Published 2016-04-25

   High·CVSS 7.8 EPSS 0.43%

   Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.