Skip to content
Heist/ feed
HighFix available

Electron: can enable Node.js integration in Web Workers despite embedder restrictions

Type: advisorySource: OSV1 source record

### Impact A `` could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed. Apps are only affected if they enable the `` tag and the embedder is unsandboxed. Apps that do not use ``, or that keep the embedder sandboxed, are not affected. ### Workarounds Remove `nodeIntegrationInWorker` from the guest preferences in a `will-attach-webview` handler, or do not enable the `` tag when loading untrusted content. ### Fixed Versions * `44.0.0-beta.5` * `43.4.1` * `42.9.2` * `41.10.6` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Announced Source revision 1
Original source ↗

GHSA-9qh4-3jw8-366w

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-9qh4-3jw8-366w

electron

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
41.10.6

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

electron

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
42.9.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

electron

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
43.4.1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

electron

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
44.0.0-beta.5

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "41.10.6"
          }
        ]
      }
    ],
    "package": {
      "name": "electron",
      "purl": "pkg:npm/electron",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "42.0.0-alpha.1"
          },
          {
            "fixed": "42.9.2"
          }
        ]
      }
    ],
    "package": {
      "name": "electron",
      "purl": "pkg:npm/electron",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "43.0.0-alpha.1"
          },
          {
            "fixed": "43.4.1"
          }
        ]
      }
    ],
    "package": {
      "name": "electron",
      "purl": "pkg:npm/electron",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "44.0.0-alpha.1"
          },
          {
            "fixed": "44.0.0-beta.5"
          }
        ]
      }
    ],
    "package": {
      "name": "electron",
      "purl": "pkg:npm/electron",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9qh4-3jw8-366w/GHSA-9qh4-3jw8-366w.json"
    }
  }
]
Related CVEs
CVE-2026-102676

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102676 · High

electron

Event
#29755 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement