CVE-2017-1000424

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-02 · updated 2026-06-17

Description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

Affected products

Atom Electron: from 1.6.4 through 1.6.11; from 1.7.0 through 1.7.5

References

https://github.com/electron/electron/pull/10008
https://github.com/electron/electron/pull/10008/files
https://github.com/electron/electron/pull/10008
https://github.com/electron/electron/pull/10008/files

Get alerted when CVE-2017-1000424 or the next vulnerability affects your stack