cve/2018/CVE-2018-15685.md

### [CVE-2018-15685](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15685)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

### POC

#### Reference
- https://www.exploit-db.com/exploits/45272/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/SexyBeast233/SecBooks
- https://github.com/cranelab/webapp-tech
- https://github.com/doyensec/awesome-electronjs-hacking
- https://github.com/lnick2023/nicenice
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/rahulr311295/Electron_RCE
- https://github.com/xbl3/awesome-cve-poc_qazbnm456