CVE-2026-102672: Electron Local Race Condition Vulnerability in Squirrel.Mac Update Installation
Summary
CVE-2026-102672: Electron: Local race condition in Squirrel.Mac update installation on macOS. Affects electron across 3 version ranges.
< 39.8.10
>= 40.0.0-alpha.1, < 41.10.5
>= 42.0.0-alpha.1, < 42.0.0-beta.2
Fixed in 39.8.10, 41.10.5 or 42.0.0-beta.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework used for building cross-platform desktop applications using web technologies. It combines Chromium and Node.js, allowing developers to create applications that work on Windows, macOS, and Linux. The framework includes the Squirrel.Mac auto-update feature, which simplifies the process of updating applications on macOS. However, this feature has a vulnerability that can be exploited by local attackers.
Vulnerability Detail
The vulnerability arises from a local race condition in the Squirrel.Mac update installation process on macOS. The privileged 'ShipIt' helper, which performs the final step of an update as root, can be manipulated by a local attacker. This could allow the attacker to overwrite files of a different application instead of the intended app that initiated the update. Exploitation requires local access to the machine, making it a moderate risk for applications that utilize Squirrel.Mac-based auto-updates.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 39.8.1039.8.10npm install electron@39.8.10 -
>= 40.0.0-alpha.1, < 41.10.541.10.5npm install electron@41.10.5 -
>= 42.0.0-alpha.1, < 42.0.0-beta.242.0.0-beta.2npm install electron@42.0.0-beta.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no application-side workarounds available. The only solution is to update to a patched version of Electron.
Conclusion
The Electron framework has a local race condition vulnerability in its Squirrel.Mac update installation process, which can lead to unauthorized file overwrites. It is crucial for developers using Electron to update to the patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for electron →
FAQ
The CVSS score of this vulnerability is 6.7, indicating a moderate severity level.
No, exploitation requires local access to the machine, making it a local attack vector.
Versions of Electron prior to 39.8.10, 41.10.5, and 42.0.0-beta.2 are affected by this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
