{"id":"CVE-2026-70597","title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed pare…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-367"],"vendor":"electron","product":"electron","affected":["electron < 39.8.8","electron >= 40.0.0-alpha.1, < 40.9.0","electron >= 41.0.0-alpha.1, < 41.2.1","electron >= 42.0.0-alpha.1, < 42.0.0-beta.3"],"patched":["electron 39.8.8","electron 40.9.1","electron 41.2.1","electron 42.0.0-beta.3"],"published":"2026-08-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:44:08.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70597","references":[{"url":"https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35","label":"security-advisories@github.com"},{"url":"https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-jm7p-cc5g-qwxx"}],"tags":["nvd","ghsa","npm"],"epss":0.00105,"epssPercentile":0.012,"aliases":["GHSA-jm7p-cc5g-qwxx"],"ecosystem":"npm","ingestedAt":"2026-08-05T15:49:00.692Z","slug":"CVE-2026-70597","body":"## Overview\n\nElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-70597)\n\nAffected packages:\n\n- `electron < 39.8.8`\n- `electron >= 40.0.0-alpha.1, < 40.9.0`\n- `electron >= 41.0.0-alpha.1, < 41.2.1`\n- `electron >= 42.0.0-alpha.1, < 42.0.0-beta.3`\n\nPatched in:\n\n- `electron 39.8.8`\n- `electron 40.9.1`\n- `electron 41.2.1`\n- `electron 42.0.0-beta.3`\n\nSource: https://github.com/advisories/GHSA-jm7p-cc5g-qwxx","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}