CVE-2026-102675

npm/electron CVE-2026-102675: high 7.4, EPSS 0.21%

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Action: Upgrade electron to 41.10.6 or later.

npm i electron@41.10.6

npm i electron@42.9.2

npm i electron@43.4.1

npm i electron@44.0.0-beta.5

Affected

Fixed versions

Sources

• osv: GHSA-j84w-jfhq-vhvj
• https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj
• https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d
• https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d
• https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397
• https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2
• https://github.com/electron/electron
• https://github.com/electron/electron/releases/tag/v41.10.6
• https://github.com/electron/electron/releases/tag/v42.9.2
• https://github.com/electron/electron/releases/tag/v43.4.1
• https://github.com/electron/electron/releases/tag/v44.0.0-beta.5

CVE-2026-102675 · published 2026-09-29T18:04:24Z · modified 2026-09-29T18:15:05.563347930Z · JSON