Damn Vulnerable ElectronJS App (DVEA) is a deliberately vulnerable ElectronJS application designed for developers and security engineers to learn about and test Electron-specific security issues.
DVEA demonstrates a vulnerable to-do list application and currently includes the following vulnerabilities:
- Cross-Site Scripting (XSS)
- XSS to Remote Code Execution (RCE)
- Deep Links to XSS
- Deep Links to RCE
Pre-built binaries for Linux (Debian) are available from the GitHub releases page.
For macOS and Windows, please build the application from source (see below).
git clone https://github.com/njmulsqb/DVEA
cd DVEA
npm install
npm run start
A walkthrough of this application is available in walkthrough.md.
Please see CONTRIBUTING.md for guidelines on how to contribute to DVEA.