GHSA-4p4r-m79c-wq3v

Source

https://github.com/advisories/GHSA-4p4r-m79c-wq3v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4p4r-m79c-wq3v/GHSA-4p4r-m79c-wq3v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4p4r-m79c-wq3v

Aliases

CVE-2026-34767

Published

2026-04-03T02:37:24Z

Modified

2026-04-06T23:21:01Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS Calculator

Summary

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

Details

Impact

Apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value.

An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls.

Apps that do not reflect external input into response headers are not affected.

Workarounds

Validate or sanitize any untrusted input before including it in a response header name or value.

Fixed Versions

41.0.3
40.8.3
39.8.3
38.8.6

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Database specific

{
    "cwe_ids":  [
        "CWE-113",
        "CWE-74"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-03T02:37:24Z",
    "nvd_published_at":  "2026-04-04T00:16:17Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

38.8.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4p4r-m79c-wq3v/GHSA-4p4r-m79c-wq3v.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

39.0.0-alpha.1

Fixed

39.8.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4p4r-m79c-wq3v/GHSA-4p4r-m79c-wq3v.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

40.0.0-alpha.1

Fixed

40.8.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4p4r-m79c-wq3v/GHSA-4p4r-m79c-wq3v.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

41.0.0-alpha.1

Fixed

41.0.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4p4r-m79c-wq3v/GHSA-4p4r-m79c-wq3v.json"