{"action":"Upgrade electron to 39.8.7 or later.","affected":[{"fixed":"39.8.7","introduced":"0"},{"fixed":"40.9.0","introduced":"40.0.0-alpha.1"},{"fixed":"41.2.0","introduced":"41.0.0-alpha.1"},{"fixed":"42.0.0-beta.1","introduced":"42.0.0-alpha.1"}],"component":"electron","cve_ids":["CVE-2026-70609"],"ecosystem":"npm","epss":0.00532,"exploited":false,"fixed_versions":["39.8.7","40.9.0","41.2.0","42.0.0-beta.1"],"ghsa_id":"GHSA-4f78-qhmw-8j8m","id":"tcs_01M5KF05G0B9T4QGF32MZGSNPJ","modified_at":"2026-08-20T05:15:07.174743690Z","published_at":"2026-08-05T17:32:47Z","references":["https://osv.dev/vulnerability/GHSA-4f78-qhmw-8j8m","https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m","https://github.com/electron/electron/pull/50665","https://github.com/electron/electron/pull/50666","https://github.com/electron/electron/pull/50667","https://github.com/electron/electron/pull/50668","https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1","https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b","https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce","https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba","https://github.com/electron/electron","https://github.com/electron/electron/releases/tag/v39.8.7","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.0","https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-4f78-qhmw-8j8m","url":"https://osv.dev/vulnerability/GHSA-4f78-qhmw-8j8m"}],"summary":"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"}