{"action":"Upgrade electron to 39.8.8 or later.","affected":[{"fixed":"39.8.8","introduced":"0"},{"fixed":"40.9.0","introduced":"40.0.0-alpha.1"},{"fixed":"41.2.1","introduced":"41.0.0-alpha.1"},{"fixed":"42.0.0-beta.3","introduced":"42.0.0-alpha.1"}],"component":"electron","cve_ids":["CVE-2026-70607"],"ecosystem":"npm","epss":0.00558,"exploited":false,"fixed_versions":["39.8.8","40.9.0","41.2.1","42.0.0-beta.3"],"ghsa_id":"GHSA-v93f-fgjr-hjrj","id":"tcs_01M5KGBBY69D22HSW947ND5A53","modified_at":"2026-08-05T16:41:06.637803Z","published_at":"2026-08-05T16:24:17Z","references":["https://osv.dev/vulnerability/GHSA-v93f-fgjr-hjrj","https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj","https://github.com/electron/electron/pull/50946","https://github.com/electron/electron/pull/50947","https://github.com/electron/electron/pull/50948","https://github.com/electron/electron/pull/50949","https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a","https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7","https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b","https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55","https://github.com/electron/electron","https://github.com/electron/electron/releases/tag/v39.8.8","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-v93f-fgjr-hjrj","url":"https://osv.dev/vulnerability/GHSA-v93f-fgjr-hjrj"}],"summary":"Electron: window.open features string controls some window options considered privileged"}