electron

Records75All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high33CVSS 7.0–8.9

Exploited now

electron records in CISA KEV

No electron vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Electron-builder 4 records HIGH Builder-util-runtime 1 record HIGH Electron 1 record MEDIUM

Records

75 records

TI-2026-39496 CVE-2026-54673 · GHSA-p2f4-r6v6-j797

Information disclosure in electron-builder

HIGH 69

electron-updater allows for automatic updates for Electron apps.

CVSS 4.0HIGH 8.2 Network Low privileges User interaction EPSS 0.00407 Published 2026-06-30 Partial fix · 26.15.0, 9.7.0 CWE-200

TI-2024-26621 CVE-2024-39698 · GHSA-9jxc-qjr9-vjxq

Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

HIGH 68

electron-updater allows for automatic updates for Electron apps.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00425 Published 2024-07-09 Fixed in 6.3.0-alpha.6 CWE-154

TI-2023-09452 CVE-2023-23623 · GHSA-gxh7-wv9q-fwfr

Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

MEDIUM 50

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00664 Published 2023-09-06 Fixed in 22.0.1, 23.0.0-alpha.2 CWE-670

TI-2026-39157 CVE-2026-54257 · GHSA-q6m5-f73j-m9mc

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

MEDIUM 46

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00428 Published 2026-06-23 Fixed in 42.3.3 CWE-120

TI-2017-09308 CVE-2017-12581 · GHSA-7fv9-m79r-j9x8

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration…

MEDIUM 45

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.06693 Published 2017-08-06 Fixed in 1.6.8 CWE-78

TI-2022-11788 CVE-2022-29247 · GHSA-mq8j-3h7h-p8g7

Exposure of Resource to Wrong Sphere in Electron

MEDIUM 44

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01089 Published 2022-06-13 Fixed in 15.5.5, 16.2.6 +2 CWE-668

TI-2020-03557 CVE-2020-4077 · GHSA-h9jc-284h-533g

Context isolation bypass via contextBridge in Electron

MEDIUM 44

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01003 Published 2020-07-07 Fixed in 8.2.4, 7.2.4 CWE-501

TI-2026-65465 CVE-2026-102676 · GHSA-9qh4-3jw8-366w

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

MEDIUM 43

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00479 Published 2026-09-29 Partial fix · 41.10.6, 42.9.2 +2 CWE-1188

TI-2026-27019 CVE-2026-34775 · GHSA-xwr5-m59h-vwqr

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

MEDIUM 43

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00294 Published 2026-04-03 Partial fix · 38.8.6, 39.8.4 +2 CWE-653

TI-2026-27015 CVE-2026-34771 · GHSA-8337-3p73-46f4

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

MEDIUM 40

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00292 Published 2026-04-03 Partial fix · 38.8.6, 39.8.0 +2 CWE-416

TI-2026-27014 CVE-2026-34770 · GHSA-jjp3-mq3x-295m

Electron: Use-after-free in PowerMonitor on Windows and macOS

MEDIUM 40

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00249 Published 2026-04-03 Fixed in 38.8.6, 39.8.1 +2 CWE-416

TI-2026-27013 CVE-2026-34769 · GHSA-9wfr-w7mm-pc7f

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

MEDIUM 40

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.003 Published 2026-04-03 Partial fix · 38.8.6, 39.8.0 +2 CWE-88

TI-2026-27009 CVE-2026-34765 · GHSA-f3pv-wv63-48x8

Electron named window.open targets not scoped to the opener's browsing context

MEDIUM 40

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00305 Published 2026-04-07 Partial fix · 39.8.5, 40.8.5 +2 CWE-668

TI-2024-19667 CVE-2024-29900 · GHSA-34h3-8mw4-qw57

@electron/packager's build process memory potentially leaked into final executable

MEDIUM 40

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00633 Published 2024-03-29 Fixed in 18.3.1 CWE-402

TI-2026-65466 CVE-2026-102677 · GHSA-qmv3-fv6v-rmhq

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

LOW 39

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00099 Published 2026-09-29 Partial fix · 42.10.0, 43.5.0 +1 CWE-20

TI-2022-16500 CVE-2022-36077 · GHSA-p2jh-44qj-pf2v

Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

LOW 39

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00688 Published 2022-11-08 Partial fix · 21.0.0-beta.1, 20.0.1 +2 CWE-200

TI-2021-16570 CVE-2021-39184 · GHSA-mpjm-v997-c4h4

Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

LOW 39

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0105 Published 2021-10-12 Fixed in 11.5.0, 12.1.0 +1 CWE-668

TI-2020-03556 CVE-2020-4076 · GHSA-m93v-9qjc-3g79

Context isolation bypass via leaked cross-context objects in Electron

LOW 39

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass.

CVSS 3.1CRITICAL 9.0 Local No auth No interaction EPSS 0.00367 Published 2020-07-07 Fixed in 8.2.4, 7.2.4 CWE-501

TI-2011-03158 CVE-2011-3582 · GHSA-6r3w-5mjf-98x6

Cross-site request forgery in electron Advanced Electron Forums

LOW 39

A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00508 Published 2020-01-22 No fix listed CWE-352

TI-2026-49325 CVE-2026-70608 · GHSA-9f4c-93c8-jc8g

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00431 Published 2026-08-05 Fixed in 39.8.10, 41.10.3 +1 CWE-1021

TI-2026-27024 CVE-2026-34780 · GHSA-jfqg-hf23-qpw2

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00333 Published 2026-04-04 Partial fix · 39.8.0, 40.7.0 +1 CWE-1188

TI-2026-27018 CVE-2026-34774 · GHSA-532v-xpq5-8h95

Electron: Use-after-free in offscreen child window paint callback

LOW 38

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00452 Published 2026-04-03 Partial fix · 39.8.1, 40.7.0 +1 CWE-416

TI-2023-13626 CVE-2023-29198 · GHSA-p7v2-p9m8-qqg7

Context isolation bypass via nested unserializable return value in Electron

LOW 38

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.0059 Published 2023-09-06 Fixed in 22.3.6, 23.2.3 +2 CWE-754

TI-2026-27016 CVE-2026-34772 · GHSA-9w97-2464-8783

Electron: Use-after-free in download save dialog callback

LOW 37

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00212 Published 2026-04-03 Partial fix · 38.8.6, 39.8.0 +3 CWE-416

TI-2020-11946 CVE-2020-15174 · GHSA-2q4g-w47c-4674

Unpreventable top-level navigation in Electron

LOW 36

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-f…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01346 Published 2020-10-06 Fixed in 8.5.1, 9.3.0 +1 CWE-20

Open these records in search →

Critical	7
High	33
Medium	30
Low	5
No CVSS	0