sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-102673 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-102673 Source advisory: MEND:CVE-2026-102673...

PT-2026-102685

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 Description Windows opened from a sandboxed top-level document do not inherit the active HTML sandb...

CVE-2026-102674: Incorrect Privilege Assignment

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a...

CVE-2026-102676: Improper Privilege Management

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration...

CVE-2026-102673: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...

CVE-2026-102677: Improper Input Validation

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

PT-2026-102977

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.0.0-beta.2 Electron versions prior to 41.10.5 Electron versions prior to 39.8.10 Description On macOS, the Squirrel.Mac auto-update framework bundled with Electron includes a privileged ShipIt helper that executes...

PT-2026-102756

Name of the Vulnerable Software and Affected Versions Electron versions 42.3.3 through 42.9.9 Electron versions 43.0.0 through 43.4.9 Electron versions 44.0.0-beta.0 through 44.0.0-beta.5 Description The sandboxed preload code cache fails to verify that a cached entry matches the preload it was...

CVE-2026-102675: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

PT-2026-102711

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 Description An Electron guest can enable nodeIntegrationInWorker for its Web Workers even when the...

PT-2026-102710

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 Description Responses served through the protocol.registerFileProtocol or...

PT-2026-102684

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.4 Electron versions prior to 42.5.2 Electron versions prior to 43.0.0 Description Popups opened from a sandboxed iframe via the OpenURLFromTab navigation path, such as links using target=" blank" or...

discord-v8-sandbox-escape

Discord Desktop V8 sandbox escape PoC Proof-of-concept exploi...

CVE-2026-100639

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100634

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

EUVD-2026-87739

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

CVE-2026-100645 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...

CVE-2026-100639 SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts from content pasted as plain-text Markdown containing a Kramdown inline attribute list IAL. Because the...