| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-183u-hw9z-67bh |
| vulnerability_id |
VCID-183u-hw9z-67bh |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34768, GHSA-jfqx-fxh3-c62j
|
| risk_score |
1.8 |
| exploitability |
0.5 |
| weighted_severity |
3.5 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-183u-hw9z-67bh |
|
| 1 |
| url |
VCID-32q7-z5g7-qude |
| vulnerability_id |
VCID-32q7-z5g7-qude |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34775, GHSA-xwr5-m59h-vwqr
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-32q7-z5g7-qude |
|
| 2 |
| url |
VCID-346j-kfxs-akf5 |
| vulnerability_id |
VCID-346j-kfxs-akf5 |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@35.7.5 |
| purl |
pkg:npm/electron@35.7.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 4 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@35.7.5 |
|
| 1 |
| url |
pkg:npm/electron@36.8.1 |
| purl |
pkg:npm/electron@36.8.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 4 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@36.8.1 |
|
| 2 |
| url |
pkg:npm/electron@37.3.1 |
| purl |
pkg:npm/electron@37.3.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 4 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@37.3.1 |
|
| 3 |
| url |
pkg:npm/electron@38.0.0-beta.6 |
| purl |
pkg:npm/electron@38.0.0-beta.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 4 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@38.0.0-beta.6 |
|
|
| aliases |
CVE-2025-55305, GHSA-vmqv-hx8q-j7mg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-346j-kfxs-akf5 |
|
| 3 |
| url |
VCID-4sa7-5jy6-jkf2 |
| vulnerability_id |
VCID-4sa7-5jy6-jkf2 |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34770, GHSA-jjp3-mq3x-295m
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| url |
VCID-6h3u-keqg-gufv |
| vulnerability_id |
VCID-6h3u-keqg-gufv |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@39.8.0 |
| purl |
pkg:npm/electron@39.8.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 12 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@39.8.0 |
|
| 2 |
| url |
pkg:npm/electron@40.7.0 |
| purl |
pkg:npm/electron@40.7.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@40.7.0 |
|
| 3 |
| url |
pkg:npm/electron@41.0.0-beta.7 |
| purl |
pkg:npm/electron@41.0.0-beta.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-59fc-ch9h-a7fu |
|
| 4 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@41.0.0-beta.7 |
|
|
| aliases |
CVE-2026-34772, GHSA-9w97-2464-8783
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6h3u-keqg-gufv |
|
| 5 |
| url |
VCID-7fkm-hs48-13hw |
| vulnerability_id |
VCID-7fkm-hs48-13hw |
| summary |
|
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@22.3.24 |
| purl |
pkg:npm/electron@22.3.24 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 18 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@22.3.24 |
|
| 1 |
| url |
pkg:npm/electron@24.8.3 |
| purl |
pkg:npm/electron@24.8.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 18 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@24.8.3 |
|
| 2 |
| url |
pkg:npm/electron@25.8.1 |
| purl |
pkg:npm/electron@25.8.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 18 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@25.8.1 |
|
| 3 |
| url |
pkg:npm/electron@26.2.1 |
| purl |
pkg:npm/electron@26.2.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 18 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@26.2.1 |
|
| 4 |
|
| 5 |
| url |
pkg:npm/electron@27.0.0-beta.1 |
| purl |
pkg:npm/electron@27.0.0-beta.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 10 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 11 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 12 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 13 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 14 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 15 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 16 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 17 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 18 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 19 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@27.0.0-beta.1 |
|
|
| aliases |
CVE-2023-44402, GHSA-7m48-wc93-9g85
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7fkm-hs48-13hw |
|
| 6 |
| url |
VCID-beaq-5xq8-d3es |
| vulnerability_id |
VCID-beaq-5xq8-d3es |
| summary |
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@22.3.21 |
| purl |
pkg:npm/electron@22.3.21 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 7 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 8 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 9 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 10 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 20 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@22.3.21 |
|
| 2 |
| url |
pkg:npm/electron@23.3.13 |
| purl |
pkg:npm/electron@23.3.13 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 7 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 8 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 9 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 10 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 11 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 12 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 13 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 14 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 15 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 16 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 17 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 18 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@23.3.13 |
|
| 3 |
| url |
pkg:npm/electron@24.7.1 |
| purl |
pkg:npm/electron@24.7.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 7 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 8 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 9 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 10 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 20 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@24.7.1 |
|
| 4 |
| url |
pkg:npm/electron@25.5.0 |
| purl |
pkg:npm/electron@25.5.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 7 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 8 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 9 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 10 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 20 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@25.5.0 |
|
| 5 |
|
| 6 |
| url |
pkg:npm/electron@26.0.0 |
| purl |
pkg:npm/electron@26.0.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 7 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 8 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 9 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 10 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 20 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@26.0.0 |
|
|
| aliases |
CVE-2023-39956, GHSA-7x97-j373-85x5
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-beaq-5xq8-d3es |
|
| 7 |
| url |
VCID-f95q-8yva-pqbg |
| vulnerability_id |
VCID-f95q-8yva-pqbg |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34779, GHSA-5rqw-r77c-jp79
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f95q-8yva-pqbg |
|
| 8 |
| url |
VCID-g6rj-h8np-g7ay |
| vulnerability_id |
VCID-g6rj-h8np-g7ay |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@39.8.0 |
| purl |
pkg:npm/electron@39.8.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 12 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@39.8.0 |
|
| 2 |
| url |
pkg:npm/electron@40.7.0 |
| purl |
pkg:npm/electron@40.7.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@40.7.0 |
|
| 3 |
|
|
| aliases |
CVE-2026-34769, GHSA-9wfr-w7mm-pc7f
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g6rj-h8np-g7ay |
|
| 9 |
| url |
VCID-hd38-x6m6-5yds |
| vulnerability_id |
VCID-hd38-x6m6-5yds |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34776, GHSA-3c8v-cfp5-9885
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hd38-x6m6-5yds |
|
| 10 |
| url |
VCID-jk3h-fgjr-kffg |
| vulnerability_id |
VCID-jk3h-fgjr-kffg |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34767, GHSA-4p4r-m79c-wq3v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jk3h-fgjr-kffg |
|
| 11 |
| url |
VCID-k9uz-dsnp-6qev |
| vulnerability_id |
VCID-k9uz-dsnp-6qev |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34765, GHSA-f3pv-wv63-48x8
|
| risk_score |
3.2 |
| exploitability |
0.5 |
| weighted_severity |
6.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k9uz-dsnp-6qev |
|
| 12 |
| url |
VCID-kznb-y8yr-7bds |
| vulnerability_id |
VCID-kznb-y8yr-7bds |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34778, GHSA-xj5x-m3f3-5x3h
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kznb-y8yr-7bds |
|
| 13 |
| url |
VCID-m48q-c84y-k7af |
| vulnerability_id |
VCID-m48q-c84y-k7af |
| summary |
|
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@28.3.2 |
| purl |
pkg:npm/electron@28.3.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@28.3.2 |
|
| 1 |
| url |
pkg:npm/electron@29.3.3 |
| purl |
pkg:npm/electron@29.3.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 14 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 15 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 16 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@29.3.3 |
|
| 2 |
| url |
pkg:npm/electron@30.0.3 |
| purl |
pkg:npm/electron@30.0.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 12 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 13 |
| vulnerability |
VCID-prfv-2m76-wkhm |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@30.0.3 |
|
|
| aliases |
CVE-2024-46993, GHSA-6r2x-8pq8-9489
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m48q-c84y-k7af |
|
| 14 |
| url |
VCID-nng3-6g42-r3ge |
| vulnerability_id |
VCID-nng3-6g42-r3ge |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@39.8.0 |
| purl |
pkg:npm/electron@39.8.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 12 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@39.8.0 |
|
| 2 |
| url |
pkg:npm/electron@40.7.0 |
| purl |
pkg:npm/electron@40.7.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@40.7.0 |
|
| 3 |
|
|
| aliases |
CVE-2026-34771, GHSA-8337-3p73-46f4
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nng3-6g42-r3ge |
|
| 15 |
| url |
VCID-p418-zdbc-tkfx |
| vulnerability_id |
VCID-p418-zdbc-tkfx |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-34781, GHSA-f37v-82c4-4x64
|
| risk_score |
2.2 |
| exploitability |
0.5 |
| weighted_severity |
4.5 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p418-zdbc-tkfx |
|
| 16 |
| url |
VCID-szv3-rj5s-7kcy |
| vulnerability_id |
VCID-szv3-rj5s-7kcy |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34773, GHSA-mwmh-mq4g-g6gr
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-szv3-rj5s-7kcy |
|
| 17 |
| url |
VCID-t4m4-64eg-j7eb |
| vulnerability_id |
VCID-t4m4-64eg-j7eb |
| summary |
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@21.0.1 |
| purl |
pkg:npm/electron@21.0.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-taqd-cs7f-mqas |
|
| 18 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 19 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 20 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 21 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@21.0.1 |
|
|
| aliases |
CVE-2022-36077, GHSA-p2jh-44qj-pf2v
|
| risk_score |
3.2 |
| exploitability |
0.5 |
| weighted_severity |
6.5 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t4m4-64eg-j7eb |
|
| 18 |
| url |
VCID-taqd-cs7f-mqas |
| vulnerability_id |
VCID-taqd-cs7f-mqas |
| summary |
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@22.3.6 |
| purl |
pkg:npm/electron@22.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 12 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 13 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 14 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 15 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 16 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 17 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 18 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 19 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 20 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 21 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@22.3.6 |
|
| 1 |
| url |
pkg:npm/electron@23.2.3 |
| purl |
pkg:npm/electron@23.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@23.2.3 |
|
| 2 |
|
| 3 |
| url |
pkg:npm/electron@24.1.0 |
| purl |
pkg:npm/electron@24.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-jw6f-farc-7bhq |
|
| 12 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 13 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 14 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 15 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 16 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 17 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 18 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 19 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 20 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
| 21 |
| vulnerability |
VCID-zj6v-hmj8-syfy |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@24.1.0 |
|
| 4 |
| url |
pkg:npm/electron@25.0.0-alpha.2 |
| purl |
pkg:npm/electron@25.0.0-alpha.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@25.0.0-alpha.2 |
|
|
| aliases |
CVE-2023-29198, GHSA-p7v2-p9m8-qqg7
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-taqd-cs7f-mqas |
|
| 19 |
| url |
VCID-u65z-257u-jfgc |
| vulnerability_id |
VCID-u65z-257u-jfgc |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters. The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@39.8.0 |
| purl |
pkg:npm/electron@39.8.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 12 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@39.8.0 |
|
| 2 |
| url |
pkg:npm/electron@40.7.0 |
| purl |
pkg:npm/electron@40.7.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@40.7.0 |
|
| 3 |
|
|
| aliases |
CVE-2026-34766, GHSA-9899-m83m-qhpj
|
| risk_score |
1.5 |
| exploitability |
0.5 |
| weighted_severity |
3.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u65z-257u-jfgc |
|
| 20 |
| url |
VCID-ve97-xkqj-33aq |
| vulnerability_id |
VCID-ve97-xkqj-33aq |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:npm/electron@40.7.0 |
| purl |
pkg:npm/electron@40.7.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 3 |
| vulnerability |
VCID-e2ch-6mpc-ykhz |
|
| 4 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 5 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 6 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 7 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 8 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 9 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 10 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 11 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@40.7.0 |
|
| 2 |
|
|
| aliases |
CVE-2026-34774, GHSA-532v-xpq5-8h95
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ve97-xkqj-33aq |
|
| 21 |
| url |
VCID-xkbg-6qfc-jqe5 |
| vulnerability_id |
VCID-xkbg-6qfc-jqe5 |
| summary |
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-34777, GHSA-r5p7-gp4j-qhrx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xkbg-6qfc-jqe5 |
|
| 22 |
| url |
VCID-zj6v-hmj8-syfy |
| vulnerability_id |
VCID-zj6v-hmj8-syfy |
| summary |
|
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
| reference_url |
https://crbug.com/1486441 |
| reference_id |
1486441 |
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Attend |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-15T16:38:17Z/ |
|
|
| url |
https://crbug.com/1486441 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
| 56 |
|
| 57 |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
|
| 64 |
|
| 65 |
|
| 66 |
|
| 67 |
|
| 68 |
|
| 69 |
|
| 70 |
|
| 71 |
| reference_url |
https://support.apple.com/kb/HT213961 |
| reference_id |
HT213961 |
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Attend |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-15T16:38:17Z/ |
|
|
| url |
https://support.apple.com/kb/HT213961 |
|
| 72 |
| reference_url |
https://support.apple.com/kb/HT213972 |
| reference_id |
HT213972 |
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Attend |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-15T16:38:17Z/ |
|
|
| url |
https://support.apple.com/kb/HT213972 |
|
| 73 |
|
| 74 |
|
| 75 |
|
| 76 |
|
| 77 |
|
| 78 |
|
| 79 |
|
| 80 |
|
| 81 |
|
| 82 |
|
| 83 |
|
| 84 |
|
| 85 |
|
| 86 |
|
| 87 |
|
| 88 |
|
| 89 |
|
| 90 |
|
| 91 |
|
| 92 |
|
| 93 |
|
| 94 |
|
| 95 |
|
| 96 |
|
| 97 |
|
| 98 |
|
| 99 |
|
| 100 |
|
| 101 |
|
| 102 |
|
| 103 |
|
| 104 |
| reference_url |
https://pastebin.com/TdkC4pDv |
| reference_id |
TdkC4pDv |
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Attend |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2023-11-15T16:38:17Z/ |
|
|
| url |
https://pastebin.com/TdkC4pDv |
|
| 105 |
|
| 106 |
|
| 107 |
|
| 108 |
|
| 109 |
|
| 110 |
|
| 111 |
|
| 112 |
|
| 113 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/electron@22.3.25 |
| purl |
pkg:npm/electron@22.3.25 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@22.3.25 |
|
| 1 |
| url |
pkg:npm/electron@23.0.0-alpha.1 |
| purl |
pkg:npm/electron@23.0.0-alpha.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-taqd-cs7f-mqas |
|
| 18 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 19 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 20 |
| vulnerability |
VCID-vwut-z8ga-ckbe |
|
| 21 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@23.0.0-alpha.1 |
|
| 2 |
| url |
pkg:npm/electron@24.8.5 |
| purl |
pkg:npm/electron@24.8.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@24.8.5 |
|
| 3 |
| url |
pkg:npm/electron@25.0.0-alpha.1 |
| purl |
pkg:npm/electron@25.0.0-alpha.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-taqd-cs7f-mqas |
|
| 18 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 19 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 20 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@25.0.0-alpha.1 |
|
| 4 |
| url |
pkg:npm/electron@25.8.4 |
| purl |
pkg:npm/electron@25.8.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@25.8.4 |
|
| 5 |
| url |
pkg:npm/electron@26.0.0-alpha.1 |
| purl |
pkg:npm/electron@26.0.0-alpha.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-7fkm-hs48-13hw |
|
| 6 |
| vulnerability |
VCID-beaq-5xq8-d3es |
|
| 7 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 8 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 9 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 10 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 11 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 12 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 13 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 14 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 15 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 16 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 17 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 18 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 19 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@26.0.0-alpha.1 |
|
| 6 |
| url |
pkg:npm/electron@26.2.4 |
| purl |
pkg:npm/electron@26.2.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@26.2.4 |
|
| 7 |
| url |
pkg:npm/electron@27.0.0-beta.8 |
| purl |
pkg:npm/electron@27.0.0-beta.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-183u-hw9z-67bh |
|
| 1 |
| vulnerability |
VCID-32q7-z5g7-qude |
|
| 2 |
| vulnerability |
VCID-346j-kfxs-akf5 |
|
| 3 |
| vulnerability |
VCID-4sa7-5jy6-jkf2 |
|
| 4 |
| vulnerability |
VCID-6h3u-keqg-gufv |
|
| 5 |
| vulnerability |
VCID-f95q-8yva-pqbg |
|
| 6 |
| vulnerability |
VCID-g6rj-h8np-g7ay |
|
| 7 |
| vulnerability |
VCID-hd38-x6m6-5yds |
|
| 8 |
| vulnerability |
VCID-jk3h-fgjr-kffg |
|
| 9 |
| vulnerability |
VCID-k9uz-dsnp-6qev |
|
| 10 |
| vulnerability |
VCID-kznb-y8yr-7bds |
|
| 11 |
| vulnerability |
VCID-m48q-c84y-k7af |
|
| 12 |
| vulnerability |
VCID-nng3-6g42-r3ge |
|
| 13 |
| vulnerability |
VCID-p418-zdbc-tkfx |
|
| 14 |
| vulnerability |
VCID-szv3-rj5s-7kcy |
|
| 15 |
| vulnerability |
VCID-u65z-257u-jfgc |
|
| 16 |
| vulnerability |
VCID-ve97-xkqj-33aq |
|
| 17 |
| vulnerability |
VCID-xkbg-6qfc-jqe5 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/electron@27.0.0-beta.8 |
|
|
| aliases |
CVE-2023-5217, GHSA-qqvq-6xgj-jw8g
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zj6v-hmj8-syfy |
|
|
|---|