@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +12 more potentially affected by CVE-2026-102676 via electron (>=42.0.0, <=42.7.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102676 Source advisory: GHSA-9QH4-3JW8-366W...

NPM: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

NPM: Electron: can enable Node.js integration in Web Workers despite embedder restrictions vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...

@cafeai/cafe-code (0.0.28), @dualityinstitute/blink (>=0.0.1, <=0.0.19) +10 more potentially affected by CVE-2026-102676 via electron (>=41.0.3, <=41.10.5)

electron NPM version =41.0.3, =0.0.1, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102676 Source advisory: GHSA-9QH4-3JW8-366W...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +31 more potentially affected by CVE-2026-102676 via electron (>=43.0.0-beta.3, <=43.4.0)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-102676 Source advisory: GHSA-9QH4-3JW8-366W...

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Impact A could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the tag and the embedder is unsandboxed. Apps that do not use , or that keep t...

Insecure Default Initialization of Resource

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the webpreferences attribute on a tag, which omitted nodeIntegrationInWorke...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +36 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =5.0.18 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +36 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =5.0.18 and more Source cves: CVE-2026-102677 Source advisory: OSV:GHSA-QMV3-FV6V-RMHQ...

@happy-nut/monacori (>=0.1.28, <=0.1.34), @hayasaka7/haya-pet (>=0.1.0, <=0.3.28) +5 more potentially affected by CVE-2026-102677 via electron (>=42.3.3, <=42.9.3)

electron NPM version =42.3.3, =0.1.28, =0.1.0, =0.5.0, =0.1.4, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102677 Source advisory: OSV:GHSA-QMV3-FV6V-RMHQ...

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

NPM: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer vulnerability discovered by ? in WordPress Npm electron versions = 42.3.3, 42.10.0...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +36 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =5.0.18 and more Source cves: CVE-2026-102677 Source advisory: GHSA-QMV3-FV6V-RMHQ...

@happy-nut/monacori (>=0.1.28, <=0.1.34), @hayasaka7/haya-pet (>=0.1.0, <=0.3.28) +5 more potentially affected by CVE-2026-102677 via electron (>=42.3.3, <=42.9.3)

electron NPM version =42.3.3, =0.1.28, =0.1.0, =0.5.0, =0.1.4, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

Protection Mechanism Failure

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Protection Mechanism Failure via insufficient keying of sandboxed preload script code cache entries, allowing a renderer...

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

@happy-nut/monacori (>=0.1.28, <=0.1.34), @hayasaka7/haya-pet (>=0.1.0, <=0.3.28) +5 more potentially affected by CVE-2026-102677 via electron (>=42.3.3, <=42.9.3)

electron NPM version =42.3.3, =0.1.28, =0.1.0, =0.5.0, =0.1.4, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102677 Source advisory: GHSA-QMV3-FV6V-RMHQ...

GHSA-QMV3-FV6V-RMHQ Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps tha...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +36 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =5.0.18 and more Source cves: CVE-2026-102677 Source advisory: MEND:CVE-2026-102677...

CVE-2026-102677

The Electron framework (versions 42.3.3 to 42.10.0 , 43.5.0 , and 44.0.0-beta.6 ) is vulnerable to a sandboxed preload code cache poisoning issue. The root cause is a lack of verification ensuring that a cached entry matches the preload it was originally served for. A compromised renderer can inj...

CVE-2026-102677 Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

EUVD-2026-89179

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...