CVE-2017-12581: OS Command Injection

August 6, 2017 (updated August 14, 2017)

Recent Electron versions do not have strict Same Origin Policy (SOP) enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user’s host.

References

nvd.nist.gov/vuln/detail/CVE-2017-12581

Code Behaviors & Features

Detect and mitigate CVE-2017-12581 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →