VS Code Susceptible to Electron-Based Vulnerability

Visual Studio Code, being based on the open source Electron framework, is among applications susceptible to a remote code execution vulnerability just patched by the Electron team this week.

New editions of Electron, developed by GitHub, were shipped to provide a fix. (Update: As noted in the comments section, VS Code users who update to version 1.19 are protected from this vulnerability. The release notes for that version state: "This update also includes a fix for an Electron security vulnerability.")

"A remote code execution vulnerability has been discovered affecting Electron apps that use custom protocol handlers," the team said in a blog post this week. "This vulnerability has been assigned the CVE identifier CVE-2018-1000006.

That Common Vulnerability and Exposures entry says:

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.

The vulnerability affects only Windows-based apps -- not macOS or Linux -- and VS Code is among Electron-based apps listed on the Electron site. Other popular programs said to be at risk include Skype, Slack, WordPress and GitHub's Atom code editor.

"We've published new versions of Electron which include fixes for this vulnerability: 1.8.2-beta.4, 1.7.11, and 1.6.16. "We urge all Electron developers to update their apps to the latest stable version immediately.

"If for some reason you are unable to upgrade your Electron version, you can append -- as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options. The double dash -- signifies the end of command options, after which only positional parameters are accepted."

The Electron post said the vulnerability affects Windows-based Electron apps that register themselves as the default handler for a protocol, such as: "myapp://".

Apps reportedly can be affected no matter how the protocol is registered, via native code, the Windows registry or the aforementioned app.setAsDefaultProtocolClient API.

The Windows Defender Security Intelligence team on Tuesday tweeted that the "recent protocol handler bug disclosed by Electror" was spotted by the Windows Defender Advanced Threat Protection tool.

About the Author

David Ramel is an editor and writer for Converge360.

comments powered by Disqus


  • Multi-Class Classification Using PyTorch: Model Accuracy

    Dr. James McCaffrey of Microsoft Research continues his four-part series on multi-class classification, designed to predict a value that can be one of three or more possible discrete values, by explaining model accuracy.

  • Python in VS Code Adds Data Viewer for Debugging

    The January 2021 update to the Python Extension for Visual Studio Code is out with a short list of new features headed by a data viewer used while debugging.

  • GitHub Ships Enterprise Server 3.0 Release Candidate

    It's described as "the biggest ever change to Enterprise Server," with improvements to Actions, Packages, mobile, security and more.

  • Attacks on .NET Apps Grow in Number, Severity, Says Security Firm

    .NET apps were found to have more serious vulnerabilities and suffer more attacks last year, according to data gathered by Contrast Labs.

Upcoming Events