{"kind": "product", "path": "vulns/npm/electron", "name": "electron", "product": "electron", "ecosystem": "npm", "items": [{"id": "CVE-2026-115570", "noindex": false, "published": "2026-10-23T18:13:53.961Z", "modified": "2026-10-23T20:56:26.712Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00478, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-115570", "title": "Electron: Mitigation for compromised eMudhra intermediate certificates", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9", "https://github.com/electron/electron/pull/55127", "https://github.com/electron/electron/pull/55128"], "fixes": ["42.11.16", "43.8.1", "44.9.1", "45.0.0-beta.6"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-114124", "noindex": false, "published": "2026-10-21T17:03:26.765Z", "modified": "2026-10-23T15:11:35.835Z", "cvss": 3.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L", "severity": "low", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114124", "title": "Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-h3v5-h239-pg29", "https://github.com/electron/electron/pull/54033", "https://github.com/electron/electron/pull/54036"], "fixes": ["42.11.6", "43.7.3", "44.4.3", "45.0.0-alpha.9"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-114122", "noindex": false, "published": "2026-10-21T16:26:34.550Z", "modified": "2026-10-21T16:26:34.550Z", "cvss": 3.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L", "severity": "low", "epss": 0.00141, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114122", "title": "Electron: Frame subscription trusts GPU-supplied frame geometry", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-3qxv-5xgr-q7w9", "https://github.com/electron/electron/pull/54036", "https://github.com/electron/electron/pull/54037"], "fixes": ["42.11.6", "43.7.3", "44.4.3", "45.0.0-alpha.9"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-114121", "noindex": false, "published": "2026-10-21T16:20:07.261Z", "modified": "2026-10-21T16:20:07.261Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00179, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114121", "title": "Electron: openExternal permission requests can be attributed to the wrong origin", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue i", "references": ["https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx", "https://github.com/electron/electron/pull/53682", "https://github.com/electron/electron/pull/53696"], "fixes": ["42.11.3", "43.7.0", "44.3.0", "45.0.0-alpha.5"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-113800", "noindex": false, "published": "2026-10-21T16:16:45.808Z", "modified": "2026-10-23T15:12:01.887Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00241, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-113800", "title": "Electron: HID and USB permission checks can be attributed to the wrong origin", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw", "https://github.com/electron/electron/pull/53656", "https://github.com/electron/electron/pull/53679"], "fixes": ["42.11.3", "43.7.0", "44.3.0", "45.0.0-alpha.5"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-113798", "noindex": false, "published": "2026-10-21T16:12:35.548Z", "modified": "2026-10-21T16:12:35.548Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.00207, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-113798", "title": "Electron: Pointer lock permission requests can be attributed to the wrong frame", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affecte", "references": ["https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g", "https://github.com/electron/electron/pull/54432", "https://github.com/electron/electron/pull/54463"], "fixes": ["42.11.9", "43.7.6", "44.5.0", "45.0.0-alpha.13"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-113797", "noindex": false, "published": "2026-10-21T16:09:00.242Z", "modified": "2026-10-21T16:09:00.242Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-113797", "title": "Electron: Extension tabs.query returns tab URLs and titles without the tabs permission", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm", "https://github.com/electron/electron/pull/52597", "https://github.com/electron/electron/pull/53353"], "fixes": ["42.11.1", "43.5.1", "44.1.1", "45.0.0-alpha.4"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-113796", "noindex": false, "published": "2026-10-21T16:04:42.688Z", "modified": "2026-10-23T15:12:14.165Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-113796", "title": "Electron: SameSite cookie restrictions are not applied to windows opened from links", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to anoth", "references": ["https://github.com/electron/electron/security/advisories/GHSA-2p8c-gr87-2676", "https://github.com/electron/electron/pull/53683", "https://github.com/electron/electron/pull/53717"], "fixes": ["42.11.3", "43.7.0", "44.3.0", "45.0.0-alpha.6"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102672", "noindex": false, "published": "2026-10-13T15:52:46.436Z", "modified": "2026-10-13T20:22:22.127Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00111, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102672", "title": "Electron: Local race condition in Squirrel.Mac update installation on macOS", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squir", "references": ["https://github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8", "https://github.com/electron/electron/pull/50745", "https://github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9"], "fixes": ["39.8.10", "41.10.5", "42.0.0-beta.2"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102677", "noindex": false, "published": "2026-09-29T17:43:26.960Z", "modified": "2026-10-02T12:18:18.477Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00099, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102677", "title": "Electron: Sandboxed preload code cache can be poisoned by a compromised renderer", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq", "https://github.com/electron/electron/pull/52480", "https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601"], "fixes": ["42.10.0", "43.5.0", "44.0.0-beta.6"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102676", "noindex": false, "published": "2026-09-29T16:56:49.007Z", "modified": "2026-09-29T19:50:28.382Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.00479, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102676", "title": "Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w", "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2", "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671"], "fixes": ["41.10.6", "42.9.2", "43.4.1", "44.0.0-beta.5"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102675", "noindex": false, "published": "2026-09-29T16:54:29.218Z", "modified": "2026-09-29T17:26:51.547Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102675", "title": "Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. T", "references": ["https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj", "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d", "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d"], "fixes": ["41.10.6", "42.9.2", "43.4.1", "44.0.0-beta.5"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102674", "noindex": false, "published": "2026-09-29T16:51:26.963Z", "modified": "2026-09-29T17:20:35.969Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102674", "title": "Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685", "https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2", "https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d"], "fixes": ["41.10.6", "42.9.2", "43.4.1", "44.0.0-beta.5"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-102673", "noindex": false, "published": "2026-09-29T16:38:41.946Z", "modified": "2026-09-30T20:11:08.290Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00132, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-102673", "title": "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not ", "references": ["https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4", "https://github.com/electron/electron/pull/52133", "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"], "fixes": ["41.10.4", "42.5.2", "43.0.0"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70612", "noindex": false, "published": "2026-08-05T17:56:41.464Z", "modified": "2026-08-05T19:03:29.121Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70612", "title": "Electron: Sandboxed iframes can launch external protocol handlers", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1", "references": ["https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp", "https://github.com/electron/electron/pull/50961", "https://github.com/electron/electron/pull/50962"], "fixes": ["39.8.8", "40.9.0", "41.2.1", "42.0.0-beta.3"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70611", "noindex": false, "published": "2026-08-05T17:49:09.144Z", "modified": "2026-08-06T03:55:50.649Z", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N", "severity": "medium", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70611", "title": "Electron: DevTools embedder handler executes arbitrary files via shell open", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp", "https://github.com/electron/electron/pull/50937", "https://github.com/electron/electron/pull/50938"], "fixes": ["39.8.9", "40.9.2", "41.2.1", "42.0.0-beta.3"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70610", "noindex": false, "published": "2026-08-05T17:41:03.016Z", "modified": "2026-08-06T14:31:10.761Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00564, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70610", "title": "Electron: contextBridge object copy honors prototype setters", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in ", "references": ["https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4", "https://github.com/electron/electron/pull/51083", "https://github.com/electron/electron/pull/51084"], "fixes": ["39.8.9", "40.9.2", "41.2.2", "42.0.0-beta.4"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70609", "noindex": false, "published": "2026-08-05T17:32:21.067Z", "modified": "2026-08-06T03:55:49.348Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00532, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70609", "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.", "references": ["https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m", "https://github.com/electron/electron/pull/50665", "https://github.com/electron/electron/pull/50666"], "fixes": ["39.8.7", "40.9.0", "41.2.0", "42.0.0-beta.1"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70608", "noindex": false, "published": "2026-08-05T17:27:15.743Z", "modified": "2026-08-05T18:46:49.877Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.00431, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70608", "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not a", "references": ["https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g", "https://github.com/electron/electron/pull/51437", "https://github.com/electron/electron/pull/51438"], "fixes": ["39.8.10", "41.10.3", "42.0.1"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}, {"id": "CVE-2026-70607", "noindex": false, "published": "2026-08-05T16:24:11.939Z", "modified": "2026-08-05T18:27:13.014Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00558, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-70607", "title": "Electron: window.open features string controls some window options considered privileged", "description": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0", "references": ["https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj", "https://github.com/electron/electron/pull/50946", "https://github.com/electron/electron/pull/50947"], "fixes": ["39.8.8", "40.9.0", "41.2.1", "42.0.0-beta.3"], "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}, {"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}]}], "total": 79, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "electron", "path": "vulns/npm/electron", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["45.0.0-alpha.13", "45.0.0-alpha.9", "45.0.0-alpha.6", "45.0.0-alpha.5", "45.0.0-alpha.4", "44.5.0", "44.4.3", "44.3.0", "44.1.1", "44.0.0-beta.6", "44.0.0-beta.5", "43.7.6"], "stats": {"recent": 14, "kev": 0}, "lastmod": "2026-10-23T20:56:26.712Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}