PT-2026-30005 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34775

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.4, 40.8.4, and 41.0.0

Description Electron, a framework for building cross-platform desktop applications, had an issue where the nodeIntegrationInWorker webPreference was not correctly scoped. In specific process-sharing situations, workers started in frames with nodeIntegrationInWorker: false could still gain Node.js integration. Applications are only at risk if they have enabled nodeIntegrationInWorker.

Recommendations Versions prior to 38.8.6 should be updated to version 38.8.6 or later. Versions prior to 39.8.4 should be updated to version 39.8.4 or later. Versions prior to 40.8.4 should be updated to version 40.8.4 or later. Versions prior to 41.0.0 should be updated to version 41.0.0 or later. Avoid enabling nodeIntegrationInWorker in applications that also open child windows or embed content with different webPreferences.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-34775

GHSA-XWR5-M59H-VWQR

Affected Products

Electron

References · 6

• https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34775 · Security Note
• https://osv.dev/vulnerability/GHSA-xwr5-m59h-vwqr · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/CVEnew/status/2040481264395043202 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040482405123850689 · Twitter Post