Is electron 43.1 vulnerable?
npm · 2 releases from 43.1.0 to 43.1.1 · latest electron is 45.2.1 · checked 1 Nov 2026
Yes: 12 known advisories
Yes. electron 43.1.1, the last 43.1 release, is affected by 12 known security advisories (5 high, 4 medium, 3 low), including CVE-2026-115570, CVE-2026-102674, CVE-2026-102675. Upgrade to 43.8.1 or later to fix all of them.
npm install electron@43.8.1Advisories affecting electron 43.1.1
Electron: Mitigation for compromised eMudhra intermediate certificates
- Affected
- >=45.0.0-alpha.1 <45.0.0-beta.6 · >=44.0.0-alpha.1 <44.9.1 · >=43.0.0-alpha.1 <43.8.1 · <42.11.16
- Fixed in
- 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6
Electron: SameSite cookie restrictions are not applied to windows opened from links
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.6 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6
Electron: Pointer lock permission requests can be attributed to the wrong frame
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.13 · >=44.0.0-alpha.1 <44.5.0 · >=43.0.0-alpha.1 <43.7.6 · <42.11.9
- Fixed in
- 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.4 · >=44.0.0-alpha.1 <44.1.1 · >=43.0.0-alpha.1 <43.5.1 · <42.11.1
- Fixed in
- 42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4
Electron: Frame subscription trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
- Affected
- <42.11.6 · >=43.0.0-alpha.1 <43.7.3 · >=44.0.0-alpha.1 <44.4.3 · >=45.0.0-alpha.1 <45.0.0-alpha.9
- Fixed in
- 42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9
Electron: openExternal permission requests can be attributed to the wrong origin
- Affected
- <42.11.3 · >=43.0.0-alpha.1 <43.7.0 · >=44.0.0-alpha.1 <44.3.0 · >=45.0.0-alpha.1 <45.0.0-alpha.5
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron: HID and USB permission checks can be attributed to the wrong origin
- Affected
- >=45.0.0-alpha.1 <45.0.0-alpha.5 · >=44.0.0-alpha.1 <44.3.0 · >=43.0.0-alpha.1 <43.7.0 · <42.11.3
- Fixed in
- 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
- Affected
- <41.10.6 · >=42.0.0-alpha.1 <42.9.2 · >=43.0.0-alpha.1 <43.4.1 · >=44.0.0-alpha.1 <44.0.0-beta.5
- Fixed in
- 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
- Affected
- >=42.3.3 <42.10.0 · >=43.0.0-beta.1 <43.5.0 · >=44.0.0-alpha.1 <44.0.0-beta.6
- Fixed in
- 42.10.0, 43.5.0, 44.0.0-beta.6
Which of your client projects are still on electron 43.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact electron version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other electron versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.