CVE-2026-34775

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:electronjs:electron::::::node.js::*
	cpe:2.3:a:electronjs:electron::::::node.js::*
	cpe:2.3:a:electronjs:electron::::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha1::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha2::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha3::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha4::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha5::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:alpha6::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta1::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta2::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta3::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta4::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta5::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta6::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta7::::node.js::*
	cpe:2.3:a:electronjs:electron:41.0.0:beta8::::node.js::*

History

No history.

Information

Published : 2026-04-04 00:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34775

Mitre link : CVE-2026-34775

CVE.ORG link : CVE-2026-34775

JSON object : View

Products Affected

electronjs

electron

CWE

CWE-653

Improper Isolation or Compartmentalization

{"id": "CVE-2026-34775", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34775", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "electron", "product": "electron", "versions": [{"status": "affected", "version": "< 38.8.6"}, {"status": "affected", "version": ">= 39.0.0-alpha.1, < 39.8.4"}, {"status": "affected", "version": ">= 40.0.0-alpha.1, < 40.8.4"}, {"status": "affected", "version": ">= 41.0.0-alpha.1, < 41.0.0"}]}]}], "published": "2026-04-04T00:16:18.597", "references": [{"url": "https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-653"}]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0."}, {"lang": "es", "value": "Electron es un framework para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. Antes de las versiones 38.8.6, 39.8.4, 40.8.4 y 41.0.0, la webPreference nodeIntegrationInWorker no estaba correctamente delimitada en todas las configuraciones. En ciertos escenarios de compartici\u00f3n de procesos, los workers generados en frames configurados con nodeIntegrationInWorker: false a\u00fan pod\u00edan recibir integraci\u00f3n de Node.js. Las aplicaciones solo se ven afectadas si habilitan nodeIntegrationInWorker. Las aplicaciones que no usan nodeIntegrationInWorker no se ven afectadas. Este problema ha sido parcheado en las versiones 38.8.6, 39.8.4, 40.8.4 y 41.0.0."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9CE003A2-03CC-4355-AA17-2CBD204EC6C3", "versionEndExcluding": "38.8.6"}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "4B7EE232-AF54-4E15-96C2-4D1B6CCAE453", "versionEndExcluding": "39.8.4", "versionStartIncluding": "39.0.0"}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0FA5994B-42A6-4C19-BEB3-BE28C74ABCEF", "versionEndExcluding": "40.8.4", "versionStartIncluding": "40.0.0"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A20225D6-F435-4D09-962D-B162F521B6AD"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "33712802-EB60-4E9A-83B8-9F2320B70CB4"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9D0A9142-54FE-47BB-9FEB-5E97528E28FE"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9E1D191F-DEAE-4DB3-9822-F31AF9FE3BAC"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha5:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "45A8192F-3D2C-4987-9BBE-7ECC3F71965D"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:alpha6:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EEA1A2E5-03DB-46CB-8427-7F31A8A7CE1C"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B2DFCE75-BD3F-4537-B5B8-14097E262EA2"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC346E25-EA43-4615-8CDB-16D15D46E4FF"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FA5B3C00-CAFC-4995-BF35-9920F3039E77"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3672F3FB-6B5E-40FD-8A92-CB4DD6BC6A93"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta5:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9EE4F8AE-21D2-4815-85B7-B7ECCC0D5059"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta6:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D195760C-7DD9-4259-9042-EDE65AEAC1D6"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta7:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B370859F-24D3-4B25-B580-1A5B6DB94BFE"}, {"criteria": "cpe:2.3:a:electronjs:electron:41.0.0:beta8:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7F47CFAE-9744-4B54-B7E4-BB8E4346FDBA"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}