All vulnerabilities
CVE-2026-102672GHSA-vv43-5jgx-7qv8

Electron: Local race condition in Squirrel.Mac update installation on macOS

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in39.8.10Also 41.10.5, 42.0.0-beta.2GitHub
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 39.8.10electron, npmGitHubnpm install electron@39.8.10
  • 41.10.5electron, npmGitHubnpm install electron@41.10.5
  • 42.0.0-beta.2electron, npmGitHubnpm install electron@42.0.0-beta.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.

Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 42.0.0-beta.2
  • 41.10.5
  • 39.8.10

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 9

  • electron, npm< 39.8.10GitHub
  • electron, npm>= 40.0.0-alpha.1, < 41.10.5GitHub
  • electron, npm>= 42.0.0-alpha.1, < 42.0.0-beta.2GitHub
  • electronaffected: < 39.8.10CVE List
  • electronaffected: >= 40.0.0-alpha.1, < 41.10.5CVE List
  • electronaffected: >= 42.0.0-alpha.1, < 42.0.0-beta.2CVE List
  • electron, npmfrom first release, fixed in 39.8.10OSV
  • electron, npmfrom 40.0.0-alpha.1, fixed in 41.10.5OSV
  • electron, npmfrom 42.0.0-alpha.1, fixed in 42.0.0-beta.2OSV

References 10