CVE-2026-34775
Node Integration Bypass in Electron Workers Enables Code Execution
Publication date: 2026-04-04
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | to 38.8.6 (exc) |
| electronjs | electron | 41.0.0 |
| electronjs | electron | From 39.0.0 (inc) to 39.8.4 (exc) |
| electronjs | electron | From 40.0.0 (inc) to 40.8.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-653 | The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34775 is a vulnerability in the Electron framework where the nodeIntegrationInWorker setting was not properly isolated in certain process-sharing scenarios.
Specifically, web workers spawned inside frames configured with nodeIntegrationInWorker set to false could still gain Node.js integration access, which they should not have.
This means that even if an application disables Node.js integration for workers, under some conditions those workers might still have access to Node.js features, potentially exposing sensitive capabilities.
The issue affects Electron versions prior to 38.8.6, 39.8.4, 40.8.4, and 41.0.0, and only impacts applications that enable nodeIntegrationInWorker.
How can this vulnerability impact me? :
If your application enables nodeIntegrationInWorker, this vulnerability can allow web workers to gain unintended Node.js integration.
This can lead to unauthorized access to sensitive data and unauthorized modification of data, as the workers could execute Node.js code they should not be able to.
The vulnerability has a CVSS v3.1 base score of 6.8, indicating a significant impact with high confidentiality and integrity risks.
However, exploitation requires specific conditions and user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects Electron applications that enable the nodeIntegrationInWorker webPreference. Detection involves verifying if your Electron application is using nodeIntegrationInWorker and if it is running a vulnerable version prior to the patched releases.
There are no specific network or system commands provided to detect this vulnerability directly. Instead, detection focuses on checking the Electron version and configuration settings within the application.
- Check the Electron version used by your application to see if it is older than 38.8.6, 39.8.4, 40.8.4, or 41.0.0.
- Review your application's code or configuration to determine if nodeIntegrationInWorker is enabled.
- If you have access to the running application environment, inspect the webPreferences settings for worker threads to confirm if nodeIntegrationInWorker is set to false but Node.js integration is still accessible.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, the primary step is to upgrade your Electron framework to one of the patched versions: 38.8.6, 39.8.4, 40.8.4, or 41.0.0.
If upgrading immediately is not possible, avoid enabling the nodeIntegrationInWorker webPreference, especially in applications that open child windows or embed content with differing webPreferences.
Review your application architecture to ensure that worker threads spawned in frames configured with nodeIntegrationInWorker: false do not receive unintended Node.js integration.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unintended Node.js integration in worker threads when the nodeIntegrationInWorker setting is enabled, potentially exposing sensitive capabilities and data. This improper isolation can lead to unauthorized data access and modification.
Such unauthorized access and modification of data could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.
Applications that do not enable nodeIntegrationInWorker are not affected, and the issue is mitigated in patched versions of Electron.