Electron: can enable Node.js integration in Web Workers despite embedder restrictions
### Impact A `` could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the `` tag and the embedder is unsandboxed. Apps that do not use ``, or that keep the embedder sandboxed, are not affected. ### Workarounds Remove `nodeIntegrationInWorker` from the guest preferences in a `will-attach-webview` handler, or do not enable the `` tag when loading untrusted content. ### Fixed Versions * `44.0.0-beta.5` * `43.4.1` * `42.9.2` * `41.10.6` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GHSA-9qh4-3jw8-366w
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-9qh4-3jw8-366w
electron
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 41.10.6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
electron
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 42.9.2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
electron
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 43.4.1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
electron
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 44.0.0-beta.5
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "41.10.6"
}
]
}
],
"package": {
"name": "electron",
"purl": "pkg:npm/electron",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.9.2"
}
]
}
],
"package": {
"name": "electron",
"purl": "pkg:npm/electron",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "43.0.0-alpha.1"
},
{
"fixed": "43.4.1"
}
]
}
],
"package": {
"name": "electron",
"purl": "pkg:npm/electron",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "44.0.0-alpha.1"
},
{
"fixed": "44.0.0-beta.5"
}
]
}
],
"package": {
"name": "electron",
"purl": "pkg:npm/electron",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
}
}
]- Related CVEs
- CVE-2026-102676
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #29755 · Revision 1
- Added to Heist Feed
- Publisher date