Latest vulnerabilities for vendor "electronjs"

electronjs Electron Node.jsElectron crashes in clipboard.readImage() on malformed clipboard image data

Risk 17

Severity

3.3

First published (updated )

CVE-2026-34781

electronjs Electron Node.jsElectron named window.open targets not scoped to the opener's browsing context

Risk 79

Severity

8.8

First published (updated )

CVE-2026-34765

electronjs Electron Node.jsElectron has a use-after-free in offscreen shared texture release() callback

Risk 32

Severity

5.5

First published (updated )

CVE-2026-34764

electronjs Electron Node.jsElectron: Context Isolation bypass via contextBridge VideoFrame transfer

Risk 71

Severity

8.4

First published (updated )

CVE-2026-34780

electronjs Electron Node.jsElectron: AppleScript injection in app.moveToApplicationsFolder on macOS

Risk 68

Severity

7.8

First published (updated )

CVE-2026-34779

electronjs Electron Node.jsElectron: Service worker can spoof executeJavaScript IPC replies

Risk 38

Severity

6.5

First published (updated )

CVE-2026-34778

electronjs Electron Node.jsElectron: Incorrect origin passed to permission request handler for iframe requests

Risk 34

Severity

5.4

First published (updated )

CVE-2026-34777

electronjs Electron Node.jsElectron: Out-of-bounds read in second-instance IPC on macOS and Linux

Risk 37

Severity

5.3

First published (updated )

CVE-2026-34776

electronjs Electron Node.jsElectron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Risk 86

Severity

9.8

First published (updated )

CVE-2026-34775

electronjs Electron Node.jsElectron: Use-after-free in offscreen child window paint callback

Risk 75

Severity

8.1

First published (updated )

CVE-2026-34774

electronjs Electron Node.jsElectron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Risk 43

Severity

7.5

First published (updated )

CVE-2026-34773

electronjs Electron Node.jsElectron: Use-after-free in download save dialog callback

Risk 77

Severity

8.8

First published (updated )

CVE-2026-34772

electronjs Electron Node.jsElectron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Risk 77

Severity

8.8

First published (updated )

CVE-2026-34771

electronjs Electron Node.jsElectron: Use-after-free in PowerMonitor on Windows and macOS

Risk 77

Severity

8.8

First published (updated )

CVE-2026-34770

electronjs Electron Node.jsElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Risk 77

Severity

8.8

First published (updated )

CVE-2026-34769

electronjs Electron Node.jsElectron: Unquoted executable path in app.setLoginItemSettings on Windows

Risk 69

Severity

7.8

First published (updated )

CVE-2026-34768

npm/electronElectron: HTTP Response Header Injection in custom protocol handlers and webRequest

Risk 37

Severity

6.5

First published (updated )

CVE-2026-34767

electronjs Electron Node.jsElectron: USB device selection not validated against filtered device list

Risk 34

Severity

5.4

First published (updated )

CVE-2026-34766

electronjs Electron Node.jsASAR Integrity bypass via filetype confusion in electron

Risk 64

Severity

7

First published (updated )

CVE-2023-44402

electronjs Electron Node.jsElectron: Out-of-package code execution when launched with arbitrary cwd

Risk 52

Severity

6.6

First published (updated )

CVE-2023-39956

electronjs Electron Node.jsContext isolation bypass via nested unserializable return value in Electron

Risk 74

Severity

8.5

First published (updated )

CVE-2023-29198

electronjs Electron Node.jsContent-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

Risk 87

Severity

9.8

First published (updated )

CVE-2023-23623

electronjs Electron Node.jsElectron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

Risk 44

Severity

7.2

First published (updated )

CVE-2022-36077

electronjs ElectronElectron's AutoUpdater module fails to validate certain nested components of the bundle

Risk 66

Severity

7.2

First published (updated )

CVE-2022-29257

electronjs ElectronExposure of Resource to Wrong Sphere in Electron

Risk 86

Severity

9.8

First published (updated )

CVE-2022-29247

electronjs ElectronRenderers can obtain access to random bluetooth device without permission in Electron

Risk 26

Severity

5

First published (updated )

CVE-2022-21718

electronjs ElectronSandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Risk 49

Severity

8.6

First published (updated )

CVE-2021-39184

electronjs PoddycastImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries

Risk 79

Severity

8.8

First published (updated )

CVE-2021-32772

electronjs ElectronElectron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

Risk 40

Severity

6.5

First published (updated )

CVE-2020-26272

electronjs Zonote Node.jsXSS

Risk 74

Severity

9

First published (updated )

CVE-2020-35717

Trending

Vendor Risk Score

Software

electronjs Electron Node.jsElectron crashes in clipboard.readImage() on malformed clipboard image data

electronjs Electron Node.jsElectron named window.open targets not scoped to the opener's browsing context

electronjs Electron Node.jsElectron has a use-after-free in offscreen shared texture release() callback

electronjs Electron Node.jsElectron: Context Isolation bypass via contextBridge VideoFrame transfer

electronjs Electron Node.jsElectron: AppleScript injection in app.moveToApplicationsFolder on macOS

Don't miss critical vulnerabilities

electronjs Electron Node.jsElectron: Service worker can spoof executeJavaScript IPC replies

electronjs Electron Node.jsElectron: Incorrect origin passed to permission request handler for iframe requests

electronjs Electron Node.jsElectron: Out-of-bounds read in second-instance IPC on macOS and Linux

electronjs Electron Node.jsElectron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

electronjs Electron Node.jsElectron: Use-after-free in offscreen child window paint callback

Don't miss critical vulnerabilities

electronjs Electron Node.jsElectron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

electronjs Electron Node.jsElectron: Use-after-free in download save dialog callback

electronjs Electron Node.jsElectron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

electronjs Electron Node.jsElectron: Use-after-free in PowerMonitor on Windows and macOS

electronjs Electron Node.jsElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Don't miss critical vulnerabilities

electronjs Electron Node.jsElectron: Unquoted executable path in app.setLoginItemSettings on Windows

npm/electronElectron: HTTP Response Header Injection in custom protocol handlers and webRequest

electronjs Electron Node.jsElectron: USB device selection not validated against filtered device list

electronjs Electron Node.jsASAR Integrity bypass via filetype confusion in electron

electronjs Electron Node.jsElectron: Out-of-package code execution when launched with arbitrary cwd

Don't miss critical vulnerabilities

electronjs Electron Node.jsContext isolation bypass via nested unserializable return value in Electron

electronjs Electron Node.jsContent-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

electronjs Electron Node.jsElectron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect

electronjs ElectronElectron's AutoUpdater module fails to validate certain nested components of the bundle

electronjs ElectronExposure of Resource to Wrong Sphere in Electron

Don't miss critical vulnerabilities

electronjs ElectronRenderers can obtain access to random bluetooth device without permission in Electron

electronjs ElectronSandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

electronjs PoddycastImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries

electronjs ElectronElectron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

electronjs Zonote Node.jsXSS

Don't miss critical vulnerabilities

Company

Resources

Contact