Improper Check for Certificate Revocation

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...

Improper Check for Certificate Revocation

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.44.1) +4 more potentially affected by CVE-2026-113796 via electron (>=44.0.0, <=44.1.1)

electron NPM version =44.0.0, =6.33.5, =2.0.0, =1.3.8, =0.3.0, =0.3.2 Source cves: CVE-2026-113796 Source advisory: OSV:GHSA-2P8C-GR87-2676...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.44.1) +4 more potentially affected by CVE-2026-113796 via electron (>=44.0.0, <=44.1.1)

electron NPM version =44.0.0, =6.33.5, =2.0.0, =1.3.8, =0.3.0, =0.3.2 Source cves: CVE-2026-113796 Source advisory: GHSA-2P8C-GR87-2676...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.44.1) +3 more potentially affected by CVE-2026-113797 via electron (44.0.0)

electron NPM version 44.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @aizakmi08/my-guy 0.1.0 - @lvce-editor/main-process =6.33.5, =2.0.0, =1.3.8, =0.3.0, =0.3.2 Source cves: CVE-2026-113797 Source advisory:...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.51.2) +9 more potentially affected by CVE-2026-114122 via electron (>=44.0.0, <=44.4.2)

electron NPM version =44.0.0, =6.33.5, =2.0.0, =0.0.13, =1.3.8, =2.5.2, =0.3.0, =0.20.0, =0.46.9 - pokedex-electron 2.0.0 Source cves: CVE-2026-114122 Source advisory: OSV:GHSA-3QXV-5XGR-Q7W9...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.44.1) +4 more potentially affected by CVE-2026-114121 via electron (>=44.0.0, <=44.1.1)

electron NPM version =44.0.0, =6.33.5, =2.0.0, =1.3.8, =0.3.0, =0.3.2 Source cves: CVE-2026-114121 Source advisory: GHSA-997Q-GVVC-JWMX...

@aizakmi08/my-guy (0.1.0), @lvce-editor/main-process (>=6.33.5, <=6.51.2) +9 more potentially affected by CVE-2026-114124 via electron (>=44.0.0, <=44.4.2)

electron NPM version =44.0.0, =6.33.5, =2.0.0, =0.0.13, =1.3.8, =2.5.2, =0.3.0, =0.20.0, =0.46.9 - pokedex-electron 2.0.0 Source cves: CVE-2026-114124 Source advisory: MEND:CVE-2026-114124...

Electron buffer error vulnerability

Versions of Electron prior to 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9 contain a buffer error vulnerability. This vulnerability arises from the main process failing to properly verify the webContents.beginFrameSubscription frame data received from the GPU process. An attacker who gains code...

EUVD-2026-101725

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +12 more potentially affected by CVE-2026-102673 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.0.0-alpha.1, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102673 Source advisory: SNYK:JS-ELECTRON-20335498...

EUVD-2026-87728

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

CVE-2026-100634: Missing Authorization

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

EUVD-2026-72687

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711

electerm versions before 5.3.15 are affected by an arbitrary command execution vulnerability in the runGlobalAsync Electron IPC handler (src/app/lib/ipc.js). The handler exposes over 40 main-process functions without a function-name allowlist or sender validation, allowing renderer-side script ex...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-87037

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-85107

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...