{"action":"Upgrade electron to 42.11.3 or later.","affected":[{"fixed":"42.11.3","introduced":"0"},{"fixed":"43.7.0","introduced":"43.0.0-alpha.1"},{"fixed":"44.3.0","introduced":"44.0.0-alpha.1"},{"fixed":"45.0.0-alpha.5","introduced":"45.0.0-alpha.1"}],"component":"electron","cve_ids":["CVE-2026-114121"],"ecosystem":"npm","exploited":false,"fixed_versions":["42.11.3","43.7.0","44.3.0","45.0.0-alpha.5"],"ghsa_id":"GHSA-997q-gvvc-jwmx","id":"tcs_01M5JMDH3VK3WEYB71TA3PQR6S","modified_at":"2026-10-22T17:00:05.173770092Z","published_at":"2026-10-22T16:43:59Z","references":["https://osv.dev/vulnerability/GHSA-997q-gvvc-jwmx","https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx","https://nvd.nist.gov/vuln/detail/CVE-2026-114121","https://github.com/electron/electron/pull/53699","https://github.com/electron/electron/pull/53698","https://github.com/electron/electron/pull/53697","https://github.com/electron/electron/pull/53696","https://github.com/electron/electron/pull/53682","https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572ce8dd","https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407a586","https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a7d98","https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6dc2c3","https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546f5ce","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5","https://github.com/electron/electron"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-997q-gvvc-jwmx","url":"https://osv.dev/vulnerability/GHSA-997q-gvvc-jwmx"}],"summary":"Electron: openExternal permission requests can be attributed to the wrong origin"}