Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M

CVE-2026-102672Electron: Local race condition in Squirrel.Mac update installation on macOS

Medium 6.7

In plain English

A medium-severity security flaw in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)<0.1%top 99.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmelectron39.8.10GHSA-vv43-5jgx-7qv8
npmelectron41.10.5GHSA-vv43-5jgx-7qv8
npmelectron42.0.0-beta.2GHSA-vv43-5jgx-7qv8

Affected products (as reported)

VendorProductVersions
electron electron < 39.8.10>= 40.0.0-alpha.1, < 41.10.5>= 42.0.0-alpha.1, < 42.0.0-beta.2

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References