https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 19:33:47 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115570 <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.</p> <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115570 https://db.gcve.eu/vuln/ghsa-jr5w-w6x2-84p9 <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.</p> <p>Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.</p> <p>Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).</p> <p>### Workarounds</p> <p>There are no app side workarounds, you must update to a patched version of Electron.</p> <p>### Fixed Versions</p> <p>* `45.0.0-beta.6` * `44.9.1` * `43.8.1` * `42.11.16`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.</p> <p>Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.</p> <p>Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).</p> <p>### Workarounds</p> <p>There are no app side workarounds, you must update to a patched version of Electron.</p> <p>### Fixed Versions</p> <p>* `45.0.0-beta.6` * `44.9.1` * `43.8.1` * `42.11.16`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> https://db.gcve.eu/vuln/ghsa-jr5w-w6x2-84p9