electron

45.0.0 · 21 Oct 2026MIT5M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	45.0.0	No known advisory
	44.9.3	Safe from 44.3.0
	43.8.3	Safe from 43.7.0
	42.11.18	Safe from 42.11.3
	41.10.7	1 open advisory, worst moderate
	40.10.6	7 open advisories, worst high
	39.8.10	5 open advisories, worst high
	38.8.6	25 open advisories, worst high
	37.10.3	38 open advisories, worst high
	36.9.5	1808 open advisories, worst critical · last release Oct 2025, no longer updated

Your version

Critical
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflowGHSA-q6m5-f73j-m9mc · 15 Jun 2026
- 42.x42.3.1 – 42.3.2Fixed in 42.3.3
Critical
Heap buffer overflow in GPUGHSA-995f-9x5r-2rcj · 25 Nov 2022
- 19.x19.0.0 – 19.1.7Fixed in 19.1.8
Critical
Chromium Remote Code Execution in electronGHSA-4w88-rjj3-x7wp · 24 Jul 2018
- 1.x1.3.1 – 1.7.7Fixed in 1.7.8
- 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated · move to 1.7.8
High
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabGHSA-hq2x-r82h-9wj4 · 29 Sep 2026
- 42.x42.0.0 – 42.5.1Fixed in 42.5.2
- 41.x41.0.0 – 41.10.3Fixed in 41.10.4
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.4
- 39.x39.0.0 – 39.8.10No fix on 39.x · move to 41.10.4
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 41.10.4
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 41.10.4
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 41.10.4
High
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsGHSA-gr2m-v5gq-v685 · 29 Sep 2026
- 43.x43.0.0 – 43.4.0Fixed in 43.4.1
- 42.x42.0.0 – 42.9.1Fixed in 42.9.2
- 41.x41.0.0 – 41.10.5Fixed in 41.10.6
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.6
- 39.x39.0.0 – 39.8.10No fix on 39.x · move to 41.10.6
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 41.10.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 41.10.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 41.10.6
High
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledGHSA-j84w-jfhq-vhvj · 29 Sep 2026
- 43.x43.0.0 – 43.4.0Fixed in 43.4.1
- 42.x42.0.0 – 42.9.1Fixed in 42.9.2
- 41.x41.0.0 – 41.10.5Fixed in 41.10.6
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.6
- 39.x39.0.0 – 39.8.10No fix on 39.x · move to 41.10.6
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 41.10.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 41.10.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 41.10.6
High
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsGHSA-9qh4-3jw8-366w · 29 Sep 2026
- 43.x43.0.0 – 43.4.0Fixed in 43.4.1
- 42.x42.0.0 – 42.9.1Fixed in 42.9.2
- 41.x41.0.0 – 41.10.5Fixed in 41.10.6
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.6
- 39.x39.0.0 – 39.8.10No fix on 39.x · move to 41.10.6
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 41.10.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 41.10.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 41.10.6
High
Electron: Sandboxed preload code cache can be poisoned by a compromised rendererGHSA-qmv3-fv6v-rmhq · 29 Sep 2026
- 43.x43.0.0 – 43.4.1Fixed in 43.5.0
- 42.x42.3.3 – 42.9.3Fixed in 42.10.0
High
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathGHSA-9f4c-93c8-jc8g · 5 Aug 2026
- 42.x42.0.0Fixed in 42.0.1
- 41.x41.0.0 – 41.10.2Fixed in 41.10.3
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.3
- 39.x39.0.0 – 39.8.9Fixed in 39.8.10
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.10
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.10
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.10
High
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsGHSA-v3j7-r9gq-3gjw · 5 Aug 2026
- 41.x41.0.0 – 41.3.0Fixed in 41.4.0
- 40.x40.0.0 – 40.9.2Fixed in 40.9.3
- 39.x39.0.0 – 39.8.9Fixed in 39.8.10
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.10
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.10
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.10
High
Electron: Context isolation bypass via Function.prototype.bind hijackGHSA-h7rp-cf8h-j98x · 5 Aug 2026
- 41.x41.0.0 – 41.2.1Fixed in 41.2.2
- 40.x40.0.0 – 40.9.1Fixed in 40.9.2
- 39.x39.0.0 – 39.8.8Fixed in 39.8.9
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.9
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.9
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.9
High
Electron: Context Isolation bypass via contextBridge VideoFrame transferGHSA-jfqg-hf23-qpw2 · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.7.0Fixed in 39.8.0
High
Electron: Use-after-free in offscreen child window paint callbackGHSA-532v-xpq5-8h95 · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.1
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.1
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.1
High
Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksGHSA-8337-3p73-46f4 · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.7.0Fixed in 39.8.0
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
High
Electron: Use-after-free in PowerMonitor on Windows and macOSGHSA-jjp3-mq3x-295m · 3 Apr 2026
- 40.x40.0.0 – 40.7.0Fixed in 40.8.0
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
High
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceGHSA-9wfr-w7mm-pc7f · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.7.0Fixed in 39.8.0
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
High
electron ASAR Integrity bypass by just modifying the contentGHSA-xw5q-g62x-2qjc · 30 Jun 2025
- 30.x30.0.0 – 30.0.4Fixed in 30.0.5
High
Electron affected by libvpx's heap buffer overflow in vp8 encodingGHSA-qqvq-6xgj-jw8g · 28 Sep 2023
- 26.x26.0.0 – 26.2.3Fixed in 26.2.4
- 25.x25.0.0 – 25.8.3Fixed in 25.8.4
- 24.x24.0.0 – 24.8.4Fixed in 24.8.5
- 22.x22.0.0 – 22.3.24Fixed in 22.3.25
- 21.x and older0.1.0 – 21.4.4No fix, no longer updated · move to 22.3.25
High
libwebp: OOB write in BuildHuffmanTableGHSA-j7hp-h8jx-5ppr · 12 Sep 2023
- 26.x26.0.0 – 26.2.0Fixed in 26.2.1
- 25.x25.0.0 – 25.8.0Fixed in 25.8.1
- 24.x24.0.0 – 24.8.2Fixed in 24.8.3
- 22.x22.0.0 – 22.3.23Fixed in 22.3.24
High
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabledGHSA-gxh7-wv9q-fwfr · 6 Sep 2023
- 22.x22.0.0Fixed in 22.0.1
High
Electron vulnerable to remote command executionGHSA-7fv9-m79r-j9x8 · 17 May 2022
- 1.x1.3.1 – 1.6.7Fixed in 1.6.8
- 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated · move to 1.6.8
High
Unpreventable top-level navigationGHSA-2q4g-w47c-4674 · 6 Oct 2020
- 10.x10.0.0Fixed in 10.0.1
- 9.x9.0.0 – 9.2.1Fixed in 9.3.0
- 8.x8.0.0 – 8.5.0Fixed in 8.5.1
High
Context isolation bypass via contextBridge in ElectronGHSA-h9jc-284h-533g · 7 Jul 2020
- 8.x8.0.0 – 8.2.3Fixed in 8.2.4
- 7.x7.0.0 – 7.2.3Fixed in 7.2.4
- 6.x and older0.1.0 – 6.1.12No fix, no longer updated · move to 7.2.4
High
Context isolation bypass via leaked cross-context objects in ElectronGHSA-m93v-9qjc-3g79 · 7 Jul 2020
- 8.x8.0.0 – 8.2.3Fixed in 8.2.4
- 7.x7.0.0 – 7.2.3Fixed in 7.2.4
- 6.x and older0.1.0 – 6.1.12No fix, no longer updated · move to 7.2.4
High
Electron webPreferences vulnerability can be used to perform remote code executionGHSA-hv9c-qwqg-qj3v · 23 Aug 2018
- 2.x2.0.0 – 2.0.7Fixed in 2.0.8
- 1.x1.7.0 – 1.8.7Fixed in 1.8.8
High
Electron protocol handler browser vulnerable to Command InjectionGHSA-fjqr-fx3f-g4rv · 26 Mar 2018
- 1.x1.3.1 – 1.8.1Fixed in 1.8.2
- 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated · move to 1.8.2
High
Electron Vulnerable to Code Execution by Re-Enabling Node.js IntegrationGHSA-8xwg-wv7v-4vqp · 26 Mar 2018
- 1.x1.7.0 – 1.8.3Fixed in 1.8.4
High
Remote Code Execution in electronGHSA-w222-53c6-c86p · 23 Jan 2018
- 1.x1.6.0 – 1.8.1Fixed in 1.8.2
High
High severity vulnerability that affects electronGHSA-gvcj-pfq2-wxj7 · 24 Oct 2017
- 0.4.x and older0.1.0 – 0.4.1No fix, no longer updated
Moderate
Electron: HID and USB permission checks can be attributed to the wrong originGHSA-fw47-9c62-h3vw · 21 Oct 2026
- 44.x44.0.0 – 44.2.0Fixed in 44.3.0
- 43.x43.0.0 – 43.6.0Fixed in 43.7.0
- 42.x42.0.0 – 42.11.2Fixed in 42.11.3
- 41.x41.0.0 – 41.10.7No fix on 41.x · move to 42.11.3
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 42.11.3
- 39.x39.0.0 – 39.8.10No fix on 39.x · move to 42.11.3
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 42.11.3
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 42.11.3
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 42.11.3
Moderate
Electron: Local race condition in Squirrel.Mac update installation on macOSGHSA-vv43-5jgx-7qv8 · 29 Sep 2026
- 41.x41.0.0 – 41.10.4Fixed in 41.10.5
- 40.x40.0.0 – 40.10.6No fix on 40.x · move to 41.10.5
- 39.x39.0.0 – 39.8.9Fixed in 39.8.10
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.10
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.10
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.10
Moderate
Electron: Sandboxed iframes can launch external protocol handlersGHSA-p2rr-rvmm-c5fp · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Moderate
Electron: DevTools embedder handler executes arbitrary files via shell openGHSA-f2r8-jv7c-xqmp · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.9.1Fixed in 40.9.2
- 39.x39.0.0 – 39.8.8Fixed in 39.8.9
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.9
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.9
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.9
Moderate
Electron: contextBridge object copy honors prototype settersGHSA-ff2p-hmqr-hxm4 · 5 Aug 2026
- 41.x41.0.0 – 41.2.1Fixed in 41.2.2
- 40.x40.0.0 – 40.9.1Fixed in 40.9.2
- 39.x39.0.0 – 39.8.8Fixed in 39.8.9
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.9
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.9
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.9
Moderate
Electron: DevTools JavaScript Injection via Unsanitized Dock State ParameterGHSA-4f78-qhmw-8j8m · 5 Aug 2026
- 41.x41.0.0 – 41.1.1Fixed in 41.2.0
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.6Fixed in 39.8.7
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.7
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.7
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.7
Moderate
Electron: window.open features string controls some window options considered privilegedGHSA-v93f-fgjr-hjrj · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Moderate
Electron: ProtocolResponse.url reuses the default session cache instead of the registering sessionGHSA-r4w5-6pfg-jxp5 · 5 Aug 2026
- 42.x42.0.0 – 42.5.0Fixed in 42.5.1
- 41.x41.0.0 – 41.9.0Fixed in 41.9.1
- 40.x40.0.0 – 40.10.5Fixed in 40.10.6
Moderate
Electron: HTTP redirect followed into local file loaderGHSA-v64r-4m7r-3mvq · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Moderate
Electron: Extension tab APIs operate across session boundariesGHSA-m55f-7gqj-fr98 · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Moderate
Electron: shell.openPath path validation bypass via embedded null byteGHSA-5c9j-mhmv-5xgx · 5 Aug 2026
- 41.x41.0.0 – 41.1.0Fixed in 41.1.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.5Fixed in 39.8.6
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.6
Moderate
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe OriginGHSA-9pf5-hg6p-4pwp · 5 Aug 2026
- 41.x41.0.0 – 41.1.1Fixed in 41.2.0
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.6Fixed in 39.8.7
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.7
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.7
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.7
Moderate
Electron: Parent process code-sign check is spoofableGHSA-jm7p-cc5g-qwxx · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Moderate
Electron: Named window.open targets not scoped to the opener's browsing contextGHSA-f3pv-wv63-48x8 · 7 Apr 2026
- 41.x41.0.0 – 41.0.4Fixed in 41.1.0
- 40.x40.0.0 – 40.8.4Fixed in 40.8.5
- 39.x39.0.0 – 39.8.4Fixed in 39.8.5
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.5
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.5
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.5
Moderate
Electron: AppleScript injection in app.moveToApplicationsFolder on macOSGHSA-5rqw-r77c-jp79 · 3 Apr 2026
- 40.x40.0.0 – 40.7.0Fixed in 40.8.0
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: Service worker can spoof executeJavaScript IPC repliesGHSA-xj5x-m3f3-5x3h · 3 Apr 2026
- 40.x40.0.0 – 40.8.0Fixed in 40.8.1
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: Incorrect origin passed to permission request handler for iframe requestsGHSA-r5p7-gp4j-qhrx · 3 Apr 2026
- 40.x40.0.0 – 40.8.0Fixed in 40.8.1
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: Out-of-bounds read in second-instance IPC on macOS and LinuxGHSA-3c8v-cfp5-9885 · 3 Apr 2026
- 40.x40.0.0 – 40.8.0Fixed in 40.8.1
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processesGHSA-xwr5-m59h-vwqr · 3 Apr 2026
- 40.x40.0.0 – 40.8.3Fixed in 40.8.4
- 39.x39.0.0 – 39.8.3Fixed in 39.8.4
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: Registry key path injection in app.setAsDefaultProtocolClient on WindowsGHSA-mwmh-mq4g-g6gr · 3 Apr 2026
- 40.x40.0.0 – 40.8.0Fixed in 40.8.1
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: Use-after-free in download save dialog callbackGHSA-9w97-2464-8783 · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.7.0Fixed in 39.8.0
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron: HTTP Response Header Injection in custom protocol handlers and webRequestGHSA-4p4r-m79c-wq3v · 3 Apr 2026
- 41.x41.0.0 – 41.0.2Fixed in 41.0.3
- 40.x40.0.0 – 40.8.2Fixed in 40.8.3
- 39.x39.0.0 – 39.8.2Fixed in 39.8.3
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Moderate
Electron has ASAR Integrity Bypass via resource modificationGHSA-vmqv-hx8q-j7mg · 3 Sep 2025
- 37.x37.0.0 – 37.3.0Fixed in 37.3.1
- 36.x36.0.0 – 36.8.0Fixed in 36.8.1
- 35.x35.0.0 – 35.7.4Fixed in 35.7.5
- 34.x and older0.1.0 – 34.5.8No fix, no longer updated · move to 35.7.5
Moderate
Electron vulnerable to Heap Buffer Overflow in NativeImageGHSA-6r2x-8pq8-9489 · 30 Jun 2025
- 30.x30.0.0 – 30.0.2Fixed in 30.0.3
- 29.x29.0.0 – 29.3.2Fixed in 29.3.3
- 28.x28.0.0 – 28.3.1Fixed in 28.3.2
- 27.x and older0.1.0 – 27.3.11No fix, no longer updated · move to 28.3.2
Moderate
ASAR Integrity bypass via filetype confusion in electronGHSA-7m48-wc93-9g85 · 1 Dec 2023
- 26.x26.0.0 – 26.2.0Fixed in 26.2.1
- 25.x25.0.0 – 25.8.0Fixed in 25.8.1
- 24.x24.0.0 – 24.8.2Fixed in 24.8.3
- 23.x23.0.0 – 23.3.13No fix on 23.x · move to 24.8.3
- 22.x22.0.0 – 22.3.23Fixed in 22.3.24
- 21.x and older0.1.0 – 21.4.4No fix, no longer updated · move to 22.3.24
Moderate
Electron vulnerable to out-of-package code execution when launched with arbitrary cwdGHSA-7x97-j373-85x5 · 6 Sep 2023
- 25.x25.0.0 – 25.4.0Fixed in 25.5.0
- 24.x24.0.0 – 24.7.0Fixed in 24.7.1
- 23.x23.0.0 – 23.3.12Fixed in 23.3.13
- 22.x22.0.0 – 22.3.18Fixed in 22.3.21
- 21.x and older0.1.0 – 21.4.4No fix, no longer updated · move to 22.3.21
Moderate
Electron context isolation bypass via nested unserializable return valueGHSA-p7v2-p9m8-qqg7 · 6 Sep 2023
- 24.x24.0.0Fixed in 24.1.0
- 23.x23.0.0 – 23.2.2Fixed in 23.2.3
- 22.x22.0.0 – 22.3.5Fixed in 22.3.6
- 21.x and older0.1.0 – 21.4.4No fix, no longer updated · move to 22.3.6
Moderate
Exfiltration of hashed SMB credentials on Windows via file:// redirectGHSA-p2jh-44qj-pf2v · 10 Nov 2022
- 20.x20.0.0Fixed in 20.0.1
- 19.x19.0.0 – 19.0.10Fixed in 19.0.11
- 18.x18.0.0 – 18.3.6Fixed in 18.3.7
- 17.x and older0.1.0 – 17.4.11No fix, no longer updated · move to 18.3.7
Moderate
AutoUpdater module fails to validate certain nested components of the bundleGHSA-77xc-hjv8-ww97 · 16 Jun 2022
- 17.x17.0.0 – 17.1.2Fixed in 17.2.0
- 16.x16.0.0 – 16.1.1Fixed in 16.2.0
- 15.x15.0.0 – 15.4.2Fixed in 15.5.0
- 14.x and older0.1.0 – 14.2.9No fix, no longer updated · move to 15.5.0
Moderate
Electron vulnerable to URL spoofing via PDFiumGHSA-6h98-cf9g-vmg2 · 13 May 2022
- 1.x1.7.0 – 1.7.5Fixed in 1.7.6
Moderate
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage APIGHSA-mpjm-v997-c4h4 · 12 Oct 2021
- 13.x13.0.0 – 13.2.3Fixed in 13.3.0
- 12.x12.0.0 – 12.0.18Fixed in 12.1.0
- 11.x11.0.0 – 11.4.12Fixed in 11.5.0
- 10.x and older0.1.0 – 10.4.7No fix, no longer updated · move to 11.5.0
Moderate
IPC messages delivered to the wrong frame in ElectronGHSA-hvf8-h2qh-37m9 · 28 Jan 2021
- 11.x11.0.0 – 11.0.5Fixed in 11.1.0
- 10.x10.0.0 – 10.1.7Fixed in 10.2.0
- 9.x9.0.0 – 9.3.5Fixed in 9.4.0
- 8.x and older0.1.0 – 8.5.5No fix, no longer updated · move to 9.4.0
Moderate
Arbitrary file read via window-open IPC in ElectronGHSA-f9mq-jph6-9mhm · 7 Jul 2020
- 8.x8.0.0 – 8.2.3Fixed in 8.2.4
- 7.x7.0.0 – 7.2.3Fixed in 7.2.4
- 6.x and older0.1.0 – 6.1.12No fix, no longer updated · move to 7.2.4
Low
Electron: Cross-origin iframe can position native autofill popupGHSA-x8rc-wpg4-grpf · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.7Fixed in 39.8.8
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.8
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.8
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.8
Low
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory sizeGHSA-pfmc-3mgc-p6fp · 5 Aug 2026
- 41.x41.0.0 – 41.2.0Fixed in 41.2.1
- 40.x40.0.0 – 40.8.5Fixed in 40.9.1
- 39.x39.0.0 – 39.8.9Fixed in 39.8.10
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.10
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.10
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.10
Low
Electron: Crash in clipboard.readImage() on malformed clipboard image dataGHSA-f37v-82c4-4x64 · 7 Apr 2026
- 41.x41.0.0 – 41.0.4Fixed in 41.1.0
- 40.x40.0.0 – 40.8.4Fixed in 40.8.5
- 39.x39.0.0 – 39.8.4Fixed in 39.8.5
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.5
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.5
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 39.8.5
Low
Electron: Use-after-free in offscreen shared texture release() callbackGHSA-8x5q-pvf5-64mp · 3 Apr 2026
- 41.x41.0.0 – 41.0.4Fixed in 41.1.0
- 40.x40.0.0 – 40.8.4Fixed in 40.8.5
- 39.x39.0.0 – 39.8.4Fixed in 39.8.5
- 38.x38.0.0 – 38.8.6No fix on 38.x · move to 39.8.5
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 39.8.5
- 36.x and older33.0.0 – 36.9.5No fix, no longer updated · move to 39.8.5
Low
Electron: Unquoted executable path in app.setLoginItemSettings on WindowsGHSA-jfqx-fxh3-c62j · 3 Apr 2026
- 40.x40.0.0 – 40.7.0Fixed in 40.8.0
- 39.x39.0.0 – 39.8.0Fixed in 39.8.1
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Low
Electron: USB device selection not validated against filtered device listGHSA-9899-m83m-qhpj · 3 Apr 2026
- 40.x40.0.0 – 40.6.1Fixed in 40.7.0
- 39.x39.0.0 – 39.7.0Fixed in 39.8.0
- 38.x38.0.0 – 38.8.4Fixed in 38.8.6
- 37.x37.0.0 – 37.10.3No fix on 37.x · move to 38.8.6
- 36.x and older0.1.0 – 36.9.5No fix, no longer updated · move to 38.8.6
Low
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabledGHSA-mq8j-3h7h-p8g7 · 16 Jun 2022
- 17.x17.0.0 – 17.1.2Fixed in 17.2.0
- 16.x16.0.0 – 16.2.5Fixed in 16.2.6
- 15.x15.0.0 – 15.5.4Fixed in 15.5.5
- 14.x and older0.1.0 – 14.2.9No fix, no longer updated · move to 15.5.5
Low
Renderers can obtain access to random bluetooth device without permission in ElectronGHSA-3p22-ghq8-v749 · 22 Mar 2022
- 16.x16.0.0 – 16.0.5Fixed in 16.0.6
- 15.x15.0.0 – 15.3.4Fixed in 15.3.5
- 14.x14.0.0 – 14.2.3Fixed in 14.2.4
- 13.x13.0.0 – 13.6.3Fixed in 13.6.6
- 12.x and older0.1.0 – 12.2.3No fix, no longer updated · move to 13.6.6
Low
Context isolation bypass in ElectronGHSA-56pc-6jqp-xqj8 · 6 Oct 2020
- 10.x10.0.0 – 10.1.1Fixed in 10.1.2
- 9.x9.0.0 – 9.3.0Fixed in 9.3.1
- 8.x8.0.0 – 8.5.1Fixed in 8.5.2
Low
Context isolation bypass via Promise in ElectronGHSA-6vrv-94jv-crrg · 7 Jul 2020
- 8.x8.0.0 – 8.2.3Fixed in 8.2.4
- 7.x7.0.0 – 7.2.3Fixed in 7.2.4
- 6.x6.0.0 – 6.1.10Fixed in 6.1.11
- 5.x and older0.1.0 – 5.0.13No fix, no longer updated · move to 6.1.11

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.