GHSA-h7rp-cf8h-j98x

Source

https://github.com/advisories/GHSA-h7rp-cf8h-j98x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h7rp-cf8h-j98x/GHSA-h7rp-cf8h-j98x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h7rp-cf8h-j98x

Aliases

CVE-2026-70601

Published

2026-08-05T15:46:08Z

Modified

2026-08-05T16:11:06Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator

Summary

Electron: Context isolation bypass via Function.prototype.bind hijack

Details

Impact

Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.

Apps are affected if they expose Promise-returning functions via contextBridge — the standard pattern for wrapping ipcRenderer.invoke — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.5
41.2.2
40.9.2
39.8.9

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Database specific

{
    "cwe_ids":  [
        "CWE-693"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-05T15:46:08Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

39.8.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h7rp-cf8h-j98x/GHSA-h7rp-cf8h-j98x.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

40.0.0-alpha.1

Fixed

40.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h7rp-cf8h-j98x/GHSA-h7rp-cf8h-j98x.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

41.0.0-alpha.1

Fixed

41.2.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h7rp-cf8h-j98x/GHSA-h7rp-cf8h-j98x.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

42.0.0-alpha.1

Fixed

42.0.0-beta.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h7rp-cf8h-j98x/GHSA-h7rp-cf8h-j98x.json"