Vulnerability in Electron

CVE-2026-102672

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Electron — versions < 39.8.10, >= 40.0.0-alpha.1, < 41.10.5, >= 42.0.0-alpha.1, < 42.0.0-beta.2

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-102672?
CVE-2026-102672 is a medium-severity vulnerability in Electron, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 6.7/10. Published 2026-10-13.
How severe is CVE-2026-102672?
Medium severity. CVSS v3 base score is 6.7 out of 10.