using native code, the Windows registry, or Electron’s app.setAsDefaultProtocolClient API.” “Such apps can be affected regardless of how the protocol is registered, e.g. The framework, formerly known as Atom Shell, is currently being developed by GitHub.Įlectron said that “apps designed to run on Windows that that register themselves as the default handler for a protocol, like myapp://, are vulnerable,” according to a statement posted to GitHub’s Electron website. Meanwhile, publishers of affected applications, such as Skype for Windows and Slack, say they have also released updates to address the vulnerability.Įlectron is a node.js, V8, and Chromium open-source framework popular with developers interested in using web technologies such as JavaScript, HTML and CSS to build desktop apps. Impacted are dozens of popular Windows applications such as Microsoft’s Skype for Windows and Slack.Įarlier this week, GitHub’s Electron team released two patched versions of the Electron framework (1.8.2-beta.4, 1.7.11, and 1.6.16) and also announced a workaround fix for the vulnerability ( CVE-2018-1000006).
Hundreds of software applications built using the developer framework called Electron may be vulnerable to a remote code execution flaw, according to developers of the framework.
0 kommentar(er)
