~ / search / GHSA-xwr5-m59h-vwqr

GHSA-xwr5-m59h-vwqr

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34775

Packages

EcosystemPackageAffectedFixed in
npm electron < 38.8.6 38.8.6
npm electron >= 39.0.0-alpha.1, < 39.8.4 39.8.4
npm electron >= 40.0.0-alpha.1, < 40.8.4 40.8.4
npm electron >= 41.0.0-alpha.1, < 41.0.0 41.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration. Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected. ### Workarounds Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences. ### Fixed Versions * `41.0.0` * `40.8.4` * `39.8.4` * `38.8.6` ### For more information If there are any questions or comments about this advisory, please email [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.