electron vulnerabilities

Build cross platform desktop apps with JavaScript, HTML, and CSS

Registry
npm
Latest
45.0.0
License
MIT
Source
github.com/electron/electron (opens the source repository in a new tab)

78 known advisories

The latest version, 45.0.0, is not affected by any of them. Projects on older versions may be.

Update to the latest version:npm install electron@45.0.0

Security advisories for electron

  • MediumGHSA-2p8c-gr87-267622 Oct 2026

    Electron: SameSite cookie restrictions are not applied to windows opened from links

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.6 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6
  • MediumGHSA-x562-297c-g43g22 Oct 2026

    Electron: Pointer lock permission requests can be attributed to the wrong frame

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.13 · >=44.0.0-alpha.1 <44.5.0 · >=43.0.0-alpha.1 <43.7.6 · <42.11.9
    Fixed in
    42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13
  • LowGHSA-98mx-cjp9-gchm22 Oct 2026

    Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.4 · >=44.0.0-alpha.1 <44.1.1 · >=43.0.0-alpha.1 <43.5.1 · <42.11.1
    Fixed in
    42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4
  • LowGHSA-3qxv-5xgr-q7w922 Oct 2026

    Electron: Frame subscription trusts GPU-supplied frame geometry

    Affected
    <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
    Fixed in
    42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
  • LowGHSA-h3v5-h239-pg2922 Oct 2026

    Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

    Affected
    <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
    Fixed in
    42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
  • MediumGHSA-997q-gvvc-jwmx22 Oct 2026

    Electron: openExternal permission requests can be attributed to the wrong origin

    Affected
    <42.11.3 · >=43.0.0-alpha.1 <43.7.0 · >=44.0.0-alpha.1 <44.3.0 · >=45.0.0-alpha.1 <45.0.0-alpha.5
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
  • MediumGHSA-fw47-9c62-h3vw21 Oct 2026

    Electron: HID and USB permission checks can be attributed to the wrong origin

    Affected
    >=45.0.0-alpha.1 <45.0.0-alpha.5 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
    Fixed in
    42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
  • MediumGHSA-vv43-5jgx-7qv829 Sept 2026

    Electron: Local race condition in Squirrel.Mac update installation on macOS

    Affected
    <39.8.10 · >=40.0.0-alpha.1 <41.10.5 · >=42.0.0-alpha.1 <42.0.0-beta.2
    Fixed in
    39.8.10, 41.10.5, 42.0.0-beta.2
  • HighGHSA-hq2x-r82h-9wj429 Sept 2026

    Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

    Affected
    <41.10.4 · >=42.0.0-alpha.1 <42.5.2 · >=43.0.0-alpha.1 <43.0.0
    Fixed in
    41.10.4, 42.5.2, 43.0.0
  • HighGHSA-gr2m-v5gq-v68529 Sept 2026

    Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • HighGHSA-j84w-jfhq-vhvj29 Sept 2026

    Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • HighGHSA-9qh4-3jw8-366w29 Sept 2026

    Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

    Affected
    <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
    Fixed in
    41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
  • HighGHSA-qmv3-fv6v-rmhq29 Sept 2026

    Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

    Affected
    >=42.3.3 <42.10.0 · >=43.0.0-beta.1 <43.5.0 · >=44.0.0-alpha.1 <44.0.0-beta.6
    Fixed in
    42.10.0, 43.5.0, 44.0.0-beta.6
  • MediumGHSA-p2rr-rvmm-c5fp5 Aug 2026

    Electron: Sandboxed iframes can launch external protocol handlers

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-f2r8-jv7c-xqmp5 Aug 2026

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-ff2p-hmqr-hxm45 Aug 2026

    Electron: contextBridge object copy honors prototype setters

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.4
    Fixed in
    39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4
  • MediumGHSA-4f78-qhmw-8j8m5 Aug 2026

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    Affected
    <39.8.7 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.0 · >=42.0.0-alpha.1 <42.0.0-beta.1
    Fixed in
    39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
  • HighGHSA-9f4c-93c8-jc8g5 Aug 2026

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    Affected
    >=42.0.0-alpha.1 <42.0.1 · >=40.0.0-alpha.1 <41.10.3 · <39.8.10
    Fixed in
    39.8.10, 41.10.3, 42.0.1
  • MediumGHSA-v93f-fgjr-hjrj5 Aug 2026

    Electron: window.open features string controls some window options considered privileged

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-r4w5-6pfg-jxp55 Aug 2026

    Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

    Affected
    >=43.0.0-alpha.1 <43.0.0 · >=42.0.0-alpha.1 <42.5.1 · >=41.0.0-alpha.1 <41.9.1 · >=40.0.0-alpha.1 <40.10.6
    Fixed in
    40.10.6, 41.9.1, 42.5.1, 43.0.0
  • MediumGHSA-v64r-4m7r-3mvq5 Aug 2026

    Electron: HTTP redirect followed into local file loader

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • HighGHSA-v3j7-r9gq-3gjw5 Aug 2026

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Affected
    >=42.0.0-alpha.1 <42.0.0 · >=41.0.0-alpha.1 <41.4.0 · >=40.0.0-alpha.1 <40.9.3 · <39.8.10
    Fixed in
    39.8.10, 40.9.3, 41.4.0, 42.0.0
  • MediumGHSA-m55f-7gqj-fr985 Aug 2026

    Electron: Extension tab APIs operate across session boundaries

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-5c9j-mhmv-5xgx5 Aug 2026

    Electron: shell.openPath path validation bypass via embedded null byte

    Affected
    >=42.0.0-alpha.1 <42.0.0-beta.1 · >=41.0.0-alpha.1 <41.1.1 · >=40.0.0-alpha.1 <40.9.0 · <39.8.6
    Fixed in
    39.8.6, 40.9.0, 41.1.1, 42.0.0-beta.1
  • HighGHSA-h7rp-cf8h-j98x5 Aug 2026

    Electron: Context isolation bypass via Function.prototype.bind hijack

    Affected
    <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.5
    Fixed in
    39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5
  • LowGHSA-x8rc-wpg4-grpf5 Aug 2026

    Electron: Cross-origin iframe can position native autofill popup

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-9pf5-hg6p-4pwp5 Aug 2026

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Affected
    <39.8.7 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.0 · >=42.0.0-alpha.1 <42.0.0-beta.1
    Fixed in
    39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
  • LowGHSA-pfmc-3mgc-p6fp5 Aug 2026

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Affected
    <39.8.10 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3
  • MediumGHSA-jm7p-cc5g-qwxx5 Aug 2026

    Electron: Parent process code-sign check is spoofable

    Affected
    <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
    Fixed in
    39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
  • CriticalGHSA-q6m5-f73j-m9mc15 Jun 2026

    Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

    Affected
    >=42.3.1 <42.3.3
    Fixed in
    42.3.3
  • LowGHSA-f37v-82c4-4x647 Apr 2026

    Electron: Crash in clipboard.readImage() on malformed clipboard image data

    Affected
    <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • MediumGHSA-f3pv-wv63-48x87 Apr 2026

    Electron: Named window.open targets not scoped to the opener's browsing context

    Affected
    <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • LowGHSA-8x5q-pvf5-64mp3 Apr 2026

    Electron: Use-after-free in offscreen shared texture release() callback

    Affected
    >=33.0.0-alpha.1 <39.8.5 · >=40.0.0-alpha.1 <40.8.5 · >=41.0.0-alpha.1 <41.1.0 · >=42.0.0-alpha.1 <42.0.0-alpha.5
    Fixed in
    39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5
  • HighGHSA-jfqg-hf23-qpw23 Apr 2026

    Electron: Context Isolation bypass via contextBridge VideoFrame transfer

    Affected
    >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    39.8.0, 40.7.0, 41.0.0-beta.8
  • MediumGHSA-5rqw-r77c-jp793 Apr 2026

    Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • MediumGHSA-xj5x-m3f3-5x3h3 Apr 2026

    Electron: Service worker can spoof executeJavaScript IPC replies

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumGHSA-r5p7-gp4j-qhrx3 Apr 2026

    Electron: Incorrect origin passed to permission request handler for iframe requests

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumGHSA-3c8v-cfp5-98853 Apr 2026

    Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumGHSA-xwr5-m59h-vwqr3 Apr 2026

    Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.4 · >=40.0.0-alpha.1 <40.8.4 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.4, 40.8.4, 41.0.0
  • HighGHSA-532v-xpq5-8h953 Apr 2026

    Electron: Use-after-free in offscreen child window paint callback

    Affected
    <39.8.1 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    39.8.1, 40.7.0, 41.0.0
  • MediumGHSA-mwmh-mq4g-g6gr3 Apr 2026

    Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.1 · >=41.0.0-alpha.1 <41.0.0
    Fixed in
    38.8.6, 39.8.1, 40.8.1, 41.0.0
  • MediumGHSA-9w97-2464-87833 Apr 2026

    Electron: Use-after-free in download save dialog callback

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.7
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7
  • HighGHSA-8337-3p73-46f43 Apr 2026

    Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • HighGHSA-jjp3-mq3x-295m3 Apr 2026

    Electron: Use-after-free in PowerMonitor on Windows and macOS

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • HighGHSA-9wfr-w7mm-pc7f3 Apr 2026

    Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • LowGHSA-jfqx-fxh3-c62j3 Apr 2026

    Electron: Unquoted executable path in app.setLoginItemSettings on Windows

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.1 · >=40.0.0-alpha.1 <40.8.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
  • MediumGHSA-4p4r-m79c-wq3v3 Apr 2026

    Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.3 · >=40.0.0-alpha.1 <40.8.3 · >=41.0.0-alpha.1 <41.0.3
    Fixed in
    38.8.6, 39.8.3, 40.8.3, 41.0.3
  • LowGHSA-9899-m83m-qhpj3 Apr 2026

    Electron: USB device selection not validated against filtered device list

    Affected
    <38.8.6 · >=39.0.0-alpha.1 <39.8.0 · >=40.0.0-alpha.1 <40.7.0 · >=41.0.0-alpha.1 <41.0.0-beta.8
    Fixed in
    38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8
  • MediumGHSA-vmqv-hx8q-j7mg3 Sept 2025

    Electron has ASAR Integrity Bypass via resource modification

    Affected
    <35.7.5 · >=36.0.0-alpha.1 <36.8.1 · >=37.0.0-alpha.1 <37.3.1 · >=38.0.0-alpha.1 <38.0.0-beta.6
    Fixed in
    35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6
  • MediumGHSA-6r2x-8pq8-948930 Jun 2025

    Electron vulnerable to Heap Buffer Overflow in NativeImage

    Affected
    <28.3.2 · >=29.0.0-alpha.1 <29.3.3 · >=30.0.0-alpha.1 <30.0.3
    Fixed in
    28.3.2, 29.3.3, 30.0.3
  • HighGHSA-xw5q-g62x-2qjc30 Jun 2025

    electron ASAR Integrity bypass by just modifying the content

    Affected
    >=30.0.0-alpha.1 <30.0.5 · >=31.0.0-alpha.1 <31.0.0-beta.1
    Fixed in
    30.0.5, 31.0.0-beta.1
  • MediumGHSA-7m48-wc93-9g851 Dec 2023

    ASAR Integrity bypass via filetype confusion in electron

    Affected
    <22.3.24 · >=24.0.0-alpha.1 <24.8.3 · >=25.0.0-alpha.1 <25.8.1 · >=26.0.0-alpha.1 <26.2.1 · >=27.0.0-alpha.1 <27.0.0-alpha.7 · >=23.0.0-alpha.1 <=23.3.13
    Fixed in
    22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-alpha.7
  • HighGHSA-qqvq-6xgj-jw8g28 Sept 2023

    Electron affected by libvpx's heap buffer overflow in vp8 encoding

    Affected
    <22.3.25 · >=24.0.0 <24.8.5 · >=25.0.0 <25.8.4 · >=26.0.0 <26.2.4 · >=27.0.0-alpha.1 <27.0.0-beta.8
    Fixed in
    22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8
  • HighGHSA-j7hp-h8jx-5ppr12 Sept 2023

    libwebp: OOB write in BuildHuffmanTable

    Affected
    >=22.0.0 <22.3.24 · >=24.0.0 <24.8.3 · >=25.0.0 <25.8.1 · >=26.0.0 <26.2.1 · >=27.0.0-beta.1 <27.0.0-beta.2
    Fixed in
    22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-beta.2
  • MediumGHSA-7x97-j373-85x56 Sept 2023

    Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

    Affected
    <22.3.19 · >=23.0.0-alpha.1 <23.3.13 · >=24.0.0-alpha.1 <24.7.1 · >=25.0.0-alpha.1 <25.5.0 · >=26.0.0-alpha.1 <26.0.0-beta.13
    Fixed in
    22.3.19, 23.3.13, 24.7.1, 25.5.0, 26.0.0-beta.13
  • MediumGHSA-p7v2-p9m8-qqg76 Sept 2023

    Electron context isolation bypass via nested unserializable return value

    Affected
    <22.3.6 · >=23.0.0-alpha.1 <23.2.3 · >=24.0.0-alpha.1 <24.0.1 · >=25.0.0-alpha.1 <25.0.0-alpha.2
    Fixed in
    22.3.6, 23.2.3, 24.0.1, 25.0.0-alpha.2
  • HighGHSA-gxh7-wv9q-fwfr6 Sept 2023

    Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled

    Affected
    >=22.0.0-beta.1 <22.0.1 · >=23.0.0-alpha.1 <23.0.0-alpha.2
    Fixed in
    22.0.1, 23.0.0-alpha.2
  • CriticalGHSA-995f-9x5r-2rcj25 Nov 2022

    Heap buffer overflow in GPU

    Affected
    >=19.0.0 <19.1.8
    Fixed in
    19.1.8
  • MediumGHSA-p2jh-44qj-pf2v10 Nov 2022

    Exfiltration of hashed SMB credentials on Windows via file:// redirect

    Affected
    <18.3.7 · >=20.0.0-beta.1 <20.0.1 · >=19.0.0-beta.1 <19.0.11
    Fixed in
    18.3.7, 19.0.11, 20.0.1
  • MediumGHSA-77xc-hjv8-ww9716 Jun 2022

    AutoUpdater module fails to validate certain nested components of the bundle

    Affected
    <15.5.0 · >=16.0.0 <16.2.0 · >=17.0.0 <17.2.0 · >=18.0.0-beta.1 <18.0.0-beta.6
    Fixed in
    15.5.0, 16.2.0, 17.2.0, 18.0.0-beta.6
  • LowGHSA-mq8j-3h7h-p8g716 Jun 2022

    Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

    Affected
    <15.5.5 · >=16.0.0 <16.2.6 · >=17.0.0 <17.2.0 · >=18.0.0-beta.1 <18.0.0-beta.6
    Fixed in
    15.5.5, 16.2.6, 17.2.0, 18.0.0-beta.6
  • HighGHSA-7fv9-m79r-j9x817 May 2022

    Electron vulnerable to remote command execution

    Affected
    <1.6.8
    Fixed in
    1.6.8
  • MediumGHSA-6h98-cf9g-vmg213 May 2022

    Electron vulnerable to URL spoofing via PDFium

    Affected
    >=1.7.0 <1.7.6
    Fixed in
    1.7.6
  • LowGHSA-3p22-ghq8-v74922 Mar 2022

    Renderers can obtain access to random bluetooth device without permission in Electron

    Affected
    <13.6.6 · >=14.0.0-beta.1 <14.2.4 · >=15.0.0-beta.1 <15.3.5 · >=16.0.0-beta.1 <16.0.6 · >=17.0.0-alpha.1 <17.0.0-alpha.6
    Fixed in
    13.6.6, 14.2.4, 15.3.5, 16.0.6, 17.0.0-alpha.6
  • MediumGHSA-mpjm-v997-c4h412 Oct 2021

    Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

    Affected
    <11.5.0 · >=12.0.0 <12.1.0 · >=13.0.0 <13.3.0
    Fixed in
    11.5.0, 12.1.0, 13.3.0
  • MediumGHSA-hvf8-h2qh-37m928 Jan 2021

    IPC messages delivered to the wrong frame in Electron

    Affected
    <9.4.0 · >=10.0.0 <10.2.0 · >=11.0.0 <11.1.0
    Fixed in
    9.4.0, 10.2.0, 11.1.0
  • LowGHSA-56pc-6jqp-xqj86 Oct 2020

    Context isolation bypass in Electron

    Affected
    >=8.0.0-beta.0 <8.5.2 · >=9.0.0-beta.0 <9.3.1 · >=10.0.0-beta.0 <10.1.2 · >=11.0.0-beta.0 <11.0.0-beta.6
    Fixed in
    8.5.2, 9.3.1, 10.1.2, 11.0.0-beta.6
  • HighGHSA-2q4g-w47c-46746 Oct 2020

    Unpreventable top-level navigation

    Affected
    >=8.0.0-beta.0 <8.5.1 · >=9.0.0-beta.0 <9.3.0 · >=10.0.0-beta.0 <10.0.1
    Fixed in
    8.5.1, 9.3.0, 10.0.1
  • MediumGHSA-f9mq-jph6-9mhm7 Jul 2020

    Arbitrary file read via window-open IPC in Electron

    Affected
    <7.2.4 · >=8.0.0 <8.2.4
    Fixed in
    7.2.4, 8.2.4
  • HighGHSA-h9jc-284h-533g7 Jul 2020

    Context isolation bypass via contextBridge in Electron

    Affected
    <7.2.4 · >=8.0.0 <8.2.4
    Fixed in
    7.2.4, 8.2.4
  • HighGHSA-m93v-9qjc-3g797 Jul 2020

    Context isolation bypass via leaked cross-context objects in Electron

    Affected
    <7.2.4 · >=8.0.0 <8.2.4
    Fixed in
    7.2.4, 8.2.4
  • LowGHSA-6vrv-94jv-crrg7 Jul 2020

    Context isolation bypass via Promise in Electron

    Affected
    <6.1.11 · >=7.0.0 <7.2.4 · >=8.0.0 <8.2.4
    Fixed in
    6.1.11, 7.2.4, 8.2.4
  • HighGHSA-hv9c-qwqg-qj3v23 Aug 2018

    Electron webPreferences vulnerability can be used to perform remote code execution

    Affected
    >=1.7.0 <1.7.16 · >=1.8.0 <1.8.8 · >=2.0.0 <2.0.8 · >=3.0.0-beta.1 <3.0.0-beta.7
    Fixed in
    1.7.16, 1.8.8, 2.0.8, 3.0.0-beta.7
  • CriticalGHSA-4w88-rjj3-x7wp24 Jul 2018

    Chromium Remote Code Execution in electron

    Affected
    <1.6.14 · >=1.7.0 <1.7.8
    Fixed in
    1.6.14, 1.7.8
  • HighGHSA-fjqr-fx3f-g4rv26 Mar 2018

    Electron protocol handler browser vulnerable to Command Injection

    Affected
    <1.8.2-beta5
    Fixed in
    1.8.2-beta5
  • HighGHSA-8xwg-wv7v-4vqp26 Mar 2018

    Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

    Affected
    >=1.7.0 <1.7.13 · >=1.8.0 <1.8.4 · >=2.0.0-beta.1 <2.0.0-beta.5
    Fixed in
    1.7.13, 1.8.4, 2.0.0-beta.5
  • HighGHSA-w222-53c6-c86p23 Jan 2018

    Remote Code Execution in electron

    Affected
    >=1.7.0 <1.7.11 · >=1.6.0 <1.6.16 · >=1.8.0 <1.8.2-beta.4
    Fixed in
    1.6.16, 1.7.11, 1.8.2-beta.4
  • HighGHSA-gvcj-pfq2-wxj724 Oct 2017

    High severity vulnerability that affects electron

    Affected
    <0.33.5
    Fixed in
    0.33.5

Which of your client projects still run an old electron?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.