CVE-2026-34775

MEDIUM

6.8

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

CVE Details

CVSS v3.1 Score6.8

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published4/4/2026

Last Modified4/4/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-653

References

https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.