Vendor

    HackerOne

    61 known vulnerabilities in products by HackerOne, 0 of them actively exploited (CISA KEV).

    Key figures

    61

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in HackerOne
    HighCVE-2018-15685

    Electronjs Electron: Remote Code Execution

    		8.1
    CriticalCVE-2020-35717

    Electronjs Zonote: Cross-Site Scripting (XSS)

    		9.0
    HighCVE-2018-1000136

    Electronjs Electron: Remote Code Execution

    		8.1
    CriticalCVE-2017-16151

    HackerOne electron node module: Code Injection

    also in 1 other product

    		9.8
    HighCVE-2018-1000118

    Electronjs Electron: Command Injection

    		8.8
    HighCVE-2021-32772

    MrChuckomo Poddycast: OS Command Injection

    		8.8
    CriticalCVE-2026-102676

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    also in 1 other product

    		8.3
    HighCVE-2020-15174

    Unpreventable top-level navigation in Electron

    also in 1 other product

    		7.5
    MediumCVE-2020-26272

    Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

    also in 1 other product

    		5.4
    HighCVE-2026-102674

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    also in 1 other product

    		8.2
    HighCVE-2020-4075

    Arbitrary file read via window-open IPC in Electron

    also in 1 other product

    		6.8
    CriticalCVE-2020-4077

    Context isolation bypass via contextBridge in Electron

    also in 1 other product

    		7.7
    HighCVE-2026-102673

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    also in 1 other product

    		8.2
    HighCVE-2026-70608

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    also in 1 other product

    		7.2
    HighCVE-2026-34774

    Electron: Use-after-free in offscreen child window paint callback

    also in 1 other product

    		8.1
    HighCVE-2026-102677

    Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

    also in 1 other product

    		7.8
    HighCVE-2026-102675

    Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    also in 1 other product

    		7.4
    HighCVE-2021-39184

    Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

    also in 1 other product

    		6.8
    MediumCVE-2026-70609

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    also in 1 other product

    		5.7
    MediumCVE-2026-70610

    Electron: contextBridge object copy honors prototype setters

    also in 1 other product

    		5.4
    HighCVE-2026-70604

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    also in 1 other product

    		7.4
    MediumCVE-2026-70607

    Electron: window.open features string controls some window options considered privileged

    also in 1 other product

    		5.3
    HighCVE-2022-29257

    Electron's AutoUpdater module fails to validate certain nested components of the bundle

    also in 1 other product

    		6.6
    HighCVE-2026-34780

    Electron: Context Isolation bypass via contextBridge VideoFrame transfer

    also in 1 other product

    		8.4
    HighCVE-2026-70601

    Electron: Context isolation bypass via Function.prototype.bind hijack

    also in 1 other product

    		7.5

    All vulnerabilities in search

    Products

    Products by HackerOne
    HackerOne electron node module590