https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 15:09:16 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102672 <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application&#39;s files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.</p> <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application&#39;s files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102672 https://db.gcve.eu/vuln/ghsa-vv43-5jgx-7qv8 <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged `ShipIt` helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application&#39;s files, as root, instead of the app that started the update. Exploitation requires local access to the machine.</p> <p>Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.</p> <p>### Workarounds</p> <p>There are no app side workarounds, you must update to a patched version of Electron.</p> <p>### Fixed Versions</p> <p>* `42.0.0-beta.2` * `41.10.5` * `39.8.10`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged `ShipIt` helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application&#39;s files, as root, instead of the app that started the update. Exploitation requires local access to the machine.</p> <p>Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.</p> <p>### Workarounds</p> <p>There are no app side workarounds, you must update to a patched version of Electron.</p> <p>### Fixed Versions</p> <p>* `42.0.0-beta.2` * `41.10.5` * `39.8.10`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> https://db.gcve.eu/vuln/ghsa-vv43-5jgx-7qv8