https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 15:58:27 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-27957 cnvd-2017-27957 https://cve.radiocsirt.org/vuln/cnvd-2017-27957 https://cve.radiocsirt.org/vuln/euvd-2026-77225 EUVD-2026-77225 https://cve.radiocsirt.org/vuln/euvd-2026-77225 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12581 <p>GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user&#39;s host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.</p> <p>GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user&#39;s host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-12581 https://cve.radiocsirt.org/vuln/ghsa-7fv9-m79r-j9x8 <p><strong>Affected:</strong> npm: electron</p> <p>Electron before 1.6.8 allows remote command execution because of a `nodeIntegration` bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user&#39;s host. Specifically, a `chrome-devtools://devtools/bundled/inspector.html` window could be used to eval a Node.js `child_process.execFile` API call.</p> <p><strong>Affected:</strong> npm: electron</p> <p>Electron before 1.6.8 allows remote command execution because of a `nodeIntegration` bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user&#39;s host. Specifically, a `chrome-devtools://devtools/bundled/inspector.html` window could be used to eval a Node.js `child_process.execFile` API call.</p> https://cve.radiocsirt.org/vuln/ghsa-7fv9-m79r-j9x8 https://cve.radiocsirt.org/vuln/gsd-2017-12581 gsd-2017-12581 https://cve.radiocsirt.org/vuln/gsd-2017-12581