GHSA-vv43-5jgx-7qv8

Source

https://github.com/advisories/GHSA-vv43-5jgx-7qv8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vv43-5jgx-7qv8/GHSA-vv43-5jgx-7qv8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vv43-5jgx-7qv8

Aliases

CVE-2026-102672

Published

2026-09-29T18:06:59Z

Modified

2026-09-29T18:15:05Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Electron: Local race condition in Squirrel.Mac update installation on macOS

Details

Impact

On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.

Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.2
41.10.5
39.8.10

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Database specific

{
    "cwe_ids":  [
        "CWE-367"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-29T18:06:59Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

39.8.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vv43-5jgx-7qv8/GHSA-vv43-5jgx-7qv8.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

40.0.0-alpha.1

Fixed

41.10.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vv43-5jgx-7qv8/GHSA-vv43-5jgx-7qv8.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

42.0.0-alpha.1

Fixed

42.0.0-beta.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vv43-5jgx-7qv8/GHSA-vv43-5jgx-7qv8.json"