CVE-2026-102677
1 advisory.
npm/electron CVE-2026-102677: high 7.8
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Action: Upgrade electron to 42.10.0 or later.
npm i electron@42.10.0npm i electron@43.5.0npm i electron@44.0.0-beta.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 42.3.3 | 42.10.0 | - |
| 43.0.0-beta.1 | 43.5.0 | - |
| 44.0.0-alpha.1 | 44.0.0-beta.6 | - |
Fixed versions
| 42.10.0 | 43.5.0 | 44.0.0-beta.6 |
Sources
- osv: GHSA-qmv3-fv6v-rmhq
- https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq
- https://github.com/electron/electron/pull/52480
- https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601
- https://github.com/electron/electron/commit/06a12a87a23f40abbf580fc7a552bc1189812c45
- https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3
- https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217
- https://github.com/electron/electron
- https://github.com/electron/electron/releases/tag/v42.10.0
- https://github.com/electron/electron/releases/tag/v43.5.0
- https://github.com/electron/electron/releases/tag/v44.0.0-beta.6
CVE-2026-102677 · published · modified · JSON