PkgSeer

Vulnerability GHSA-vv43-5jgx-7qv8

Medium Risk
MEDIUM RISK
CVSS Score: 6.7
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
22 days ago
September 29, 2026 at 06:06 PM UTC
Electron: Local race condition in Squirrel.Mac update installation on macOS
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1

Summary

Electron: Local race condition in Squirrel.Mac update installation on macOS

Details

Impact

On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.

Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 42.0.0-beta.2
  • 41.10.5
  • 39.8.10

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
2 hours ago
Electron: HID and USB permission checks can be attributed to the wrong origin
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
High Risk
22 days ago
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
High Risk
22 days ago
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-gr2m-v5gq-v685
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-gr2m-v5gq-v685
High Risk
22 days ago
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
High Risk
22 days ago
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-9qh4-3jw8-366w
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-9qh4-3jw8-366w
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
22 days ago
September 29, 2026 at 06:06 PM UTC
Fixed (39.8.10)
5 months ago
May 05, 2026 at 08:55 PM UTC
Fixed (41.10.5)
Unknown
Unknown
Fixed (42.0.0-beta.2)
Unknown
Unknown
Last Modified
22 days ago
September 29, 2026 at 06:15 PM UTC