Search for vulnerabilities
Vulnerability details: VCID-5qfu-3eye-yua5
Vulnerability ID VCID-5qfu-3eye-yua5
Aliases CVE-2018-1000006
GHSA-w222-53c6-c86p
Summary Remote Code Execution in electron Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met: 1. The electron application is running on Windows. 2. The electron application registers as the default handler for a protocol, such as `nodeapp://`. This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron. MacOS and Linux are not vulnerable. ## Recommendation Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance: If for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted. ``` app.setAsDefaultProtocolClient(protocol, process.execPath, [ '--your-switches-here', '--' ]) ```
Status Published
Exploitability 2.0
Weighted Severity 8.4
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.9209 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.9209 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.9209 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.9209 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.92178 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.92178 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
epss 0.92178 https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
cvssv3.1 8.8 https://electronjs.org/blog/protocol-handler-fix
generic_textual HIGH https://electronjs.org/blog/protocol-handler-fix
cvssv3.1 8.8 https://github.com/advisories/GHSA-w222-53c6-c86p
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-w222-53c6-c86p
generic_textual HIGH https://github.com/advisories/GHSA-w222-53c6-c86p
cvssv3.1 8.8 https://github.com/electron/electron/releases/tag/v1.8.2-beta.4
generic_textual HIGH https://github.com/electron/electron/releases/tag/v1.8.2-beta.4
cvssv3.1 8.8 https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
generic_textual HIGH https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
cvssv2 9.3 https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
cvssv3.1 8.8 https://www.exploit-db.com/exploits/43899
generic_textual HIGH https://www.exploit-db.com/exploits/43899
cvssv3.1 8.8 https://www.exploit-db.com/exploits/44357
generic_textual HIGH https://www.exploit-db.com/exploits/44357
cvssv3.1 8.8 https://www.npmjs.com/advisories/563
generic_textual HIGH https://www.npmjs.com/advisories/563
cvssv3.1 8.8 http://www.securityfocus.com/bid/102796
generic_textual HIGH http://www.securityfocus.com/bid/102796
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-1000006
https://electronjs.org/blog/protocol-handler-fix
https://github.com/advisories/GHSA-w222-53c6-c86p
https://github.com/electron/electron/releases/tag/v1.8.2-beta.4
https://medium.com/%40Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
https://www.exploit-db.com/exploits/43899
https://www.exploit-db.com/exploits/43899/
https://www.exploit-db.com/exploits/44357
https://www.exploit-db.com/exploits/44357/
https://www.npmjs.com/advisories/563
http://www.securityfocus.com/bid/102796
CVE-2018-1000006 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/43899.html
CVE-2018-1000006 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/44357.rb
CVE-2018-1000006 Exploit https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
CVE-2018-1000006 Exploit https://raw.githubusercontent.com/rapid7/metasploit-framework/0a0bef0c4fc52c418782015b1b49daf067ce964c/modules/exploits/windows/browser/exodus.rb
Data source Exploit-DB
Date added March 29, 2018
Description Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date March 29, 2018
Exploit type remote
Platform windows
Source update date March 29, 2018
Source URL https://raw.githubusercontent.com/rapid7/metasploit-framework/0a0bef0c4fc52c418782015b1b49daf067ce964c/modules/exploits/windows/browser/exodus.rb
Data source Metasploit
Description This module exploits a Remote Code Execution vulnerability in Exodus Wallet, a vulnerability in the ElectronJS Framework protocol handler can be used to get arbitrary command execution if the user clicks on a specially crafted URL.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Jan. 25, 2018
Platform Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/browser/exodus.rb
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://electronjs.org/blog/protocol-handler-fix
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-w222-53c6-c86p
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/releases/tag/v1.8.2-beta.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1000006
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/43899
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/44357
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.npmjs.com/advisories/563
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/102796
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99697
EPSS Score 0.9209
Published At Sept. 13, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:56:05.846852+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-w222-53c6-c86p/GHSA-w222-53c6-c86p.json 37.0.0