CVE-2026-34775

MEDIUM

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Title source: cna

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

References (1)

[X_Refsource_Confirm] https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr

Scores

CVSS v3 6.8

EPSS 0.0001

EPSS Percentile 1.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Details

CWE

CWE-653

Status published

Products (7)

electron/electron < 38.8.6

electron/electron >= 39.0.0-alpha.1, < 39.8.4

electron/electron >= 40.0.0-alpha.1, < 40.8.4

electron/electron >= 41.0.0-alpha.1, < 41.0.0

electronjs/electron 41.0.0 alpha1 (14 CPE variants)

electronjs/electron < 38.8.6

npm/electron 0 - 38.8.6npm

Published Apr 04, 2026

Tracked Since Apr 04, 2026