CVE-2018-1000006: Electron protocol handler allows arbitrary command execution on Windows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with high CVSS (8.8), very high EPSS and public exploit code, though it requires user interaction and is not in KEV.

What it is

Electron apps on Windows (10, 7, 2008) that register custom protocol handlers can be tricked into executing arbitrary commands when a user clicks a specially crafted URL. The flaw is an OS command injection in the protocol handler, fixed in 1.8.2-beta.4, 1.7.11 and 1.6.16. It matters because any Electron-based desktop app with a registered protocol is exposed to remote code execution through a single user click.

Impact

An attacker who gets a victim to click a crafted URL gains arbitrary command execution in the context of the Electron application, with high impact to confidentiality, integrity and availability.

Attack surface

Reached over the network via a crafted URL that triggers the app's registered custom protocol handler; no authentication is required but user interaction (a click) is required per the CVSS vector UI:R.

Exploitation

Not listed in CISA KEV, but EPSS is 0.845 (99.7th percentile) and public exploit code exists on Exploit-DB, indicating active interest and practical exploitability.

What to do

• Upgrade Electron to 1.8.2-beta.4, 1.7.11, 1.6.16 or later, and rebuild/release affected applications.
• Audit which custom protocol handlers your Electron apps register and remove or restrict any that are not strictly needed.
• Validate and sanitize all input passed from protocol handler URLs before it reaches command execution paths.
• Warn users not to click unsolicited protocol links and consider blocking unknown protocol launches at the OS level.

Detection

• Monitor process creation events for Electron app processes spawning unexpected child processes such as cmd.exe or powershell.exe.
• Log and review invocations of registered custom protocol handlers, especially those originating from email, chat or browser links.
• Alert on command lines containing shell metacharacters passed through protocol handler arguments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.