Government of the Republic of Trinidad and Tobago
gov.tt

TTCSIRT-083.013018: TT-CSIRT Advisory – JavaScript Security Updates

TTCSIRT-083.013018: TT-CSIRT Advisory – JavaScript Security Updates

A security update has been released for the popular Electron JavaScript library which is used in the development of desktop applications that utilize web components such as Skype and Slack.

A vulnerability has been identified in the library where if the victim navigates to a specially crafted link that calls the app.setAsDefaultProtocolClient method in the Electron API, remote code execution could take place which would allow the attacker to install programs; view, change, or delete data; or create new accounts with full user rights.

Further information on how this vulnerability and how it can be mitigated can be found at https://www.cisecurity.org/advisory/a-vulnerability-in-electron-could-allow-for-remote-code-execution_2018-012/