Is electron 41.2 vulnerable?
npm · 3 releases from 41.2.0 to 41.2.2 · latest electron is 45.2.1 · checked 2 Nov 2026
Yes: 16 known advisories
Yes. electron 41.2.2, the last 41.2 release, is affected by 16 known security advisories (7 high, 6 medium, 3 low), including CVE-2026-115570, CVE-2026-102673, CVE-2026-102674. 10 more affect earlier 41.2.x releases. Upgrade to 42.11.16 or later to fix all of them.
npm install electron@42.11.16Advisories affecting electron 41.2.2
Electron: Mitigation for compromised eMudhra intermediate certificates
- Affected
- >=45.0.0-alpha.1 <45.0.0-beta.6 · >=44.0.0-alpha.1 <44.9.1 · >=43.0.0-alpha.1 <43.8.1 · <42.11.16
- Fixed in
- 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6
Electron: SameSite cookie restrictions are not applied to windows opened from links
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.6 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6
Electron: Pointer lock permission requests can be attributed to the wrong frame
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.13 · >=44.0.0-alpha.1 <44.5.0 · >=43.0.0-alpha.1 <43.7.6 · <42.11.9
- Fixed in
- 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.4 · >=44.0.0-alpha.1 <44.1.1 · >=43.0.0-alpha.1 <43.5.1 · <42.11.1
- Fixed in
- 42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4
Electron: Frame subscription trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: openExternal permission requests can be attributed to the wrong origin
- Affected
- <42.11.3 · >=43.0.0-alpha.1 <43.7.0 · >=44.0.0-alpha.1 <44.3.0 · >=45.0.0-alpha.1 <45.0.0-alpha.5
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron: HID and USB permission checks can be attributed to the wrong origin
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.5 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron: Local race condition in Squirrel.Mac update installation on macOS
- Affected
- <39.8.10 · >=40.0.0-alpha.1 <41.10.5 · >=42.0.0-alpha.1 <42.0.0-beta.2
- Fixed in
- 39.8.10, 41.10.5, 42.0.0-beta.2
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- Affected
- <41.10.4 · >=42.0.0-alpha.1 <42.5.2 · >=43.0.0-alpha.1 <43.0.0
- Fixed in
- 41.10.4, 42.5.2, 43.0.0
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
- Affected
- >=42.0.0-alpha.1 <42.0.1 · >=40.0.0-alpha.1 <41.10.3 · <39.8.10
- Fixed in
- 39.8.10, 41.10.3, 42.0.1
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
- Affected
- >=43.0.0-alpha.1 <43.0.0 · >=42.0.0-alpha.1 <42.5.1 · >=41.0.0-alpha.1 <41.9.1 · >=40.0.0-alpha.1 <40.10.6
- Fixed in
- 40.10.6, 41.9.1, 42.5.1, 43.0.0
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
- Affected
- >=42.0.0-alpha.1 <42.0.0 · >=41.0.0-alpha.1 <41.4.0 · >=40.0.0-alpha.1 <40.9.3 · <39.8.10
- Fixed in
- 39.8.10, 40.9.3, 41.4.0, 42.0.0
Fixed within 41.2.x, affecting earlier releases
Electron: Sandboxed iframes can launch external protocol handlers
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
Electron: DevTools embedder handler executes arbitrary files via shell open
- Affected
- <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3
Electron: contextBridge object copy honors prototype setters
- Affected
- <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.4
- Fixed in
- 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4
Electron: window.open features string controls some window options considered privileged
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
Electron: HTTP redirect followed into local file loader
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
Electron: Extension tab APIs operate across session boundaries
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
Electron: Context isolation bypass via Function.prototype.bind hijack
- Affected
- <39.8.9 · >=40.0.0-alpha.1 <40.9.2 · >=41.0.0-alpha.1 <41.2.2 · >=42.0.0-alpha.1 <42.0.0-beta.5
- Fixed in
- 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5
Electron: Cross-origin iframe can position native autofill popup
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
- Affected
- <39.8.10 · >=40.0.0-alpha.1 <40.9.0 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3
Electron: Parent process code-sign check is spoofable
- Affected
- <39.8.8 · >=40.0.0-alpha.1 <40.9.1 · >=41.0.0-alpha.1 <41.2.1 · >=42.0.0-alpha.1 <42.0.0-beta.3
- Fixed in
- 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
Which of your client projects are still on electron 41.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact electron version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other electron versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.