Product by HackerOne
HackerOne electron node module
59 known vulnerabilities in HackerOne electron node module (HackerOne), 0 of them actively exploited (CISA KEV).
Key figures
59
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2018-15685 | Electronjs Electron: Remote Code Execution | 8.1 | |
| High | CVE-2018-1000136 | Electronjs Electron: Remote Code Execution | 8.1 | |
| Critical | CVE-2017-16151 | HackerOne electron node module: Code Injection | 9.8 | |
| High | CVE-2018-1000118 | Electronjs Electron: Command Injection | 8.8 | |
| Critical | CVE-2026-102676 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | 8.3 | |
| High | CVE-2020-15174 | Unpreventable top-level navigation in Electron | 7.5 | |
| Medium | CVE-2020-26272 | Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs | 5.4 | |
| High | CVE-2026-102674 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions | 8.2 | |
| High | CVE-2020-4075 | Arbitrary file read via window-open IPC in Electron | 6.8 | |
| Critical | CVE-2020-4077 | Context isolation bypass via contextBridge in Electron | 7.7 | |
| High | CVE-2026-102673 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab | 8.2 | |
| High | CVE-2026-70608 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path | 7.2 | |
| High | CVE-2026-34774 | Electron: Use-after-free in offscreen child window paint callback | 8.1 | |
| High | CVE-2026-102677 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer | 7.8 | |
| High | CVE-2026-102675 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled | 7.4 | |
| High | CVE-2021-39184 | Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API | 6.8 | |
| Medium | CVE-2026-70609 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter | 5.7 | |
| Medium | CVE-2026-70610 | Electron: contextBridge object copy honors prototype setters | 5.4 | |
| High | CVE-2026-70604 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads | 7.4 | |
| Medium | CVE-2026-70607 | Electron: window.open features string controls some window options considered privileged | 5.3 | |
| High | CVE-2022-29257 | Electron's AutoUpdater module fails to validate certain nested components of the bundle | 6.6 | |
| High | CVE-2026-34780 | Electron: Context Isolation bypass via contextBridge VideoFrame transfer | 8.4 | |
| High | CVE-2026-70601 | Electron: Context isolation bypass via Function.prototype.bind hijack | 7.5 | |
| Critical | CVE-2023-23623 | Electron: Always-Incorrect Control Flow Implementation | 7.5 | |
| Medium | CVE-2026-70612 | Electron: Sandboxed iframes can launch external protocol handlers | 5.4 |