GitHub Advisoryadvisory · npm

GHSA-xwr5-m59h-vwqr Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

MEDIUM Published 2026-04-03 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-34775
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-653
Reviewed
2026-04-03

Affected packages

• npm electron: < 38.8.6 → fixed in 38.8.6 • npm electron: >= 39.0.0-alpha.1, < 39.8.4 → fixed in 39.8.4 • npm electron: >= 40.0.0-alpha.1, < 40.8.4 → fixed in 40.8.4 • npm electron: >= 41.0.0-alpha.1, < 41.0.0 → fixed in 41.0.0

Description

Impact The `nodeIntegrationInWorker` webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with `nodeIntegrationInWorker: false` could still receive Node.js integration. Apps are only affected if they enable `nodeIntegrationInWorker`. Apps that do not use `nodeIntegrationInWorker` are not affected. Workarounds Avoid enabling `nodeIntegrationInWorker` in apps that also open child windows or embed content with differing webPreferences. Fixed Versions • `41.0.0` • `40.8.4` • `39.8.4` • `38.8.6` For more information If there are any questions or comments about this advisory, please email [email protected]

Related

Alias · CVE (1)

  • CVE-2026-34775 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability

Weakness · CWE (1)

  • CWE-653 Improper Isolation or Compartmentalization weakness

References