cve-2020-35717

CVE-2020–35717 zonote allows XSS via crafted note, with resultant Remote Code Execution because Node.js integration is enabled. Steps to exploit the vulnerability Download any zonote affected version Open zonote app Import xss-rce.znt in zonote via Menu Open Hover over the different links in...

CVE-2026-102676

A flaw was found in Electron. This vulnerability allows untrusted guest content loaded inside an embedded web view to run background worker tasks with elevated privileges. By enabling Node.js integration within background web workers, an attacker can bypass security restrictions set by the host...

GHSA-9QH4-3JW8-366W Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Impact A could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the tag and the embedder is unsandboxed. Apps that do not use , or that keep t...

NPM: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

NPM: Electron: can enable Node.js integration in Web Workers despite embedder restrictions vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Impact A could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the tag and the embedder is unsandboxed. Apps that do not use , or that keep t...

CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration...

CVE-2026-102676 Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration...

CVE-2026-26462: Improper Neutralization of Special Elements used in an Expression Language Statement

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrar...

CVE-2026-34775: Improper Isolation or Compartmentalization

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers...

@dweb-browser/desktop (0.1.2), @dweb-browser/js-process (0.1.2) +27 more potentially affected by CVE-2023-44402 via electron (>=25.0.0-beta.1, <=25.8.0)

electron NPM version =25.0.0-beta.1, =1.0.0, =1.0.0, =0.6.0, =0.0.22, =0.0.93, =0.0.95 - firedev 16.444.5 - firedev-class-helpers 16.444.4 - firedev-config 16.444.4 - firedev-core 16.444.5 - firedev-logger 16.444.4 - firedev-rest 16.444.3 - firedev-storage 16.444.4 and more Source cves:...

@ascua/electron (0.0.228), @jessezzhang/motion-core (>=0.0.1, <=0.0.5) +9 more potentially affected by CVE-2022-36077 via electron (>=18.0.0, <=18.3.2)

electron NPM version =18.0.0, =0.0.1, =0.0.21, =1.2.1, =2.0.72, =3.15.3, =0.0.0, =18.0.0, =1.0.0, =1.0.1 Source cves: CVE-2022-36077 Source advisory: OSV:GHSA-P2JH-44QJ-PF2V...

@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29247 via electron (>=17.0.0, <=17.1.2)

electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

@finsemble/finsemble-electron-adapter (>=5.4.0, <=6.0.0), @innomind/studio (>=2.5.16, <=2.6.38) +19 more potentially affected by CVE-2021-39184 via electron (>=11.0.0, <=11.4.9)

electron NPM version =11.0.0, =5.4.0, =2.5.16, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.18.1, =0.32.0-alpha.47, =0.3.280, =1.0.0, =0.3.0, =4.0.1, =2.6.30, =2.6.42 - katex-screenshot 1.4.1 and more Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-15096 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

@donmahallem/trapeze-client-electron (>=1.5.3, <=1.6.0), @evgenious/electron-prebuilt-compile (6.0.3) +13 more potentially affected by CVE-2020-15096 via electron (>=6.0.0, <=6.1.10)

electron NPM version =6.0.0, =1.5.3, =6.0.0-beta.1, =6.0.0-beta.1, =0.1.0, =0.5.17, =1.0.2, =3.0.2, =1.1.6, =3.0.3, =0.0.1, =0.0.38 Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

@ftnk/electron-prebuilt-compile (1.7.3), @philipptrenz/photo-booth (>=1.0.1, <=1.0.6) +68 more potentially affected by CVE-2018-15685 via electron (>=1.7.0, <=1.7.13)

electron NPM version =1.7.0, =1.0.1, =1.0.0, =1.0.1, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.4.0-next.ff386514 and more Source...

Code Execution by Re-enabling Node.js integration

Overview A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows executi...

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it. For the application to be impacted by this vulnerability it must meet all of these conditions - Runs on Electron 1.7, 1.8, or a 2.0.0-beta - Allows execution of...

electron-prebuilt-compile (1.8.1) potentially affected by CVE-2018-1000006 via electron (1.8.1)

electron NPM version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - electron-prebuilt-compile 1.8.1 Source cves: CVE-2018-1000006 Source advisory: OSV:GHSA-W222-53C6-C86P...