PkgSeer

Vulnerability GHSA-9qh4-3jw8-366w

High Risk
HIGH RISK
CVSS Score: 8.3
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
22 days ago
September 29, 2026 at 06:02 PM UTC
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4

Summary

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

Details

Impact

A <webview> could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.

Apps are only affected if they enable the <webview> tag and the embedder is unsandboxed. Apps that do not use <webview>, or that keep the embedder sandboxed, are not affected.

Workarounds

Remove nodeIntegrationInWorker from the guest preferences in a will-attach-webview handler, or do not enable the <webview> tag when loading untrusted content.

Fixed Versions

  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
2 hours ago
Electron: HID and USB permission checks can be attributed to the wrong origin
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
Medium Risk
22 days ago
Electron: Local race condition in Squirrel.Mac update installation on macOS
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1 GHSA-vv43-5jgx-7qv8
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1 GHSA-vv43-5jgx-7qv8
High Risk
22 days ago
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
High Risk
22 days ago
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-gr2m-v5gq-v685
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-gr2m-v5gq-v685
High Risk
22 days ago
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
22 days ago
September 29, 2026 at 06:02 PM UTC
Fixed (43.4.1)
2 months ago
August 19, 2026 at 01:44 AM UTC
Fixed (41.10.6)
Unknown
Unknown
Fixed (42.9.2)
Unknown
Unknown
Fixed (44.0.0-beta.5)
Unknown
Unknown
Last Modified
22 days ago
September 29, 2026 at 06:15 PM UTC