CVE-2026-102676: Electron Package Vulnerability Allowing Node.js Integration in Web Workers
Summary
CVE-2026-102676: Electron: can enable Node.js integration in Web Workers despite embedder restrictions. Affects electron across 4 version ranges.
< 41.10.6
>= 42.0.0-alpha.1, < 42.9.2
>= 43.0.0-alpha.1, < 43.4.1
>= 44.0.0-alpha.1, < 44.0.0-beta.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework that enables developers to build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS. It combines the Chromium rendering engine and the Node.js runtime, allowing for rich desktop applications. However, a recent vulnerability has been identified that could allow unauthorized Node.js integration in Web Workers, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from a flaw in the Electron framework where a <webview> can enable Node.js integration in its Web Workers, even if the embedder has disabled Node.js integration. This could grant guest content more privileges than intended, leading to potential security risks such as unauthorized access to system resources or sensitive data. The issue primarily affects applications that utilize the <webview> tag without proper sandboxing.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 41.10.641.10.6npm install electron@41.10.6 -
>= 42.0.0-alpha.1, < 42.9.242.9.2npm install electron@42.9.2 -
>= 43.0.0-alpha.1, < 43.4.143.4.1npm install electron@43.4.1 -
>= 44.0.0-alpha.1, < 44.0.0-beta.544.0.0-beta.5npm install electron@44.0.0-beta.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can remove the 'nodeIntegrationInWorker' setting from the guest preferences in the 'will-attach-webview' handler. Alternatively, avoid enabling the <webview> tag when loading untrusted content. Example code to remove the setting:
webview.addEventListener('will-attach-webview', (event) => {
event.preventDefault();
event.newGuest.nodeIntegrationInWorker = false;
});
Conclusion
In summary, the identified vulnerability in the Electron framework allows for unauthorized Node.js integration in Web Workers, posing significant security risks. It is crucial for developers to update their Electron packages to the patched versions or implement the recommended workarounds to safeguard their applications.
See every vulnerability recorded for electron →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
The vulnerability affects all versions of Electron prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Failure to address this vulnerability could lead to unauthorized access to system resources and sensitive data, potentially compromising the security of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Applications using <webview> should either update to a patched version of Electron or implement the suggested workarounds to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
