@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +64 more potentially affected by CVE-2026-102672 via electron (>=40.0.0, <=41.10.3)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-102672 Source advisory: MEND:CVE-2026-102672...

CVE-2026-102677

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-102672 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +64 more potentially affected by CVE-2026-102672 via electron (>=40.0.0, <=41.10.3)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-102672 Source advisory: GHSA-VV43-5JGX-7QV8...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +64 more potentially affected by CVE-2026-102672 via electron (>=40.0.0, <=41.10.3)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-102672 Source advisory: OSV:GHSA-VV43-5JGX-7QV8...

NPM: Electron: Local race condition in Squirrel.Mac update installation on macOS

NPM: Electron: Local race condition in Squirrel.Mac update installation on macOS vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-102672 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

GHSA-VV43-5JGX-7QV8 Electron: Local race condition in Squirrel.Mac update installation on macOS

Impact On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +64 more potentially affected by CVE-2026-102672 via electron (>=40.0.0, <=41.10.3)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-102672 Source advisory: SNYK:JS-ELECTRON-20335469...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-102672 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the Squirrel.Mac installer component SQRLInstaller, where the target...

Electron: Local race condition in Squirrel.Mac update installation on macOS

Impact On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-102673 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102673 Source advisory: GHSA-HQ2X-R82H-9WJ4...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +9 more potentially affected by CVE-2026-102673 via electron (>=41.0.3, <=41.10.3)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102673 Source advisory: GHSA-HQ2X-R82H-9WJ4...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +9 more potentially affected by CVE-2026-102673 via electron (>=41.0.3, <=41.10.3)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102673 Source advisory: SNYK:JS-ELECTRON-20335498...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-102673 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102673 Source advisory: OSV:GHSA-HQ2X-R82H-9WJ4...

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab vulnerability discovered by ? in WordPress Npm electron versions 41.10.4...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-102673 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102673 Source advisory: SNYK:JS-ELECTRON-20335498...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-102673 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-102673 Source advisory: GHSA-HQ2X-R82H-9WJ4...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-102673 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-102673 Source advisory: SNYK:JS-ELECTRON-20335498...