Electron — CVE history (npm)
Electron
66 CVEs affect the Electron npm package (highest CVSS 9.8). Latest disclosed: 2026-09-29. Full CVE history sourced from NVD.
Summary
- Package
Electron(npm)- Total CVEs
66- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.8- Latest disclosed
- 2026-09-29
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-102676 | High | 8.3 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-102675 | High | 7.4 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-102674 | High | 8.2 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-102673 | High | 8.2 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70612 | Medium | 5.4 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70611 | Medium | 6.9 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70610 | Medium | 5.4 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70609 | Medium | 5.7 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70608 | High | 7.2 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70607 | Medium | 5.3 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70606 | Medium | 5.9 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70605 | Medium | 5.9 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70604 | High | 7.4 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70603 | Medium | 6.0 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70602 | Medium | 6.6 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70601 | High | 7.5 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70600 | Low | 3.1 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70599 | Medium | 5.9 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70598 | Low | 3.9 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-70597 | Medium | 6.3 | — | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2017-16151 | Critical | 9.8 | — | 2018-06-07 | Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. |
CVE-2018-1000118 | High | 8.8 | — | 2018-03-07 | Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. |
CVE-2018-1000006 | High | 8.8 | — | 2018-01-24 | GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can b… |
CVE-2026-102676 | High | 8.3 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-34780 | High | 8.3 | — | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-102674 | High | 8.2 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-102673 | High | 8.2 | — | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2026-34774 | High | 8.1 | — | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. |
CVE-2018-15685 | High | 8.1 | — | 2018-08-23 | GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform… |
CVE-2018-1000136 | High | 8.1 | — | 2018-03-23 | Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. |