CVE-2026-102672: Medium severity npm/electron vulnerability
Impact
On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.
Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
42.0.0-beta.2 41.10.5 39.8.10
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.10.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.10.5 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.2
Event History
Frequently Asked Questions
Which deployments are affected?
Only Electron applications running on macOS that ship Squirrel.Mac-based automatic updates are affected. Electron applications on other platforms, and macOS applications that do not use Squirrel.Mac auto-updates, are not affected.
What access does an attacker need to exploit this issue?
An attacker requires local access to the macOS machine. The vulnerable privileged ShipIt helper can then be caused to overwrite another application's files with root privileges during an update.
Are there mitigations if an Electron update cannot be deployed immediately?
No application-side workaround is provided. The stated remediation is to update Electron to a patched version.
Which Electron releases contain the fix?
The issue is fixed in Electron 42.0.0-beta.2, 41.10.5, and 39.8.10.