Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
    Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs     could be attributed to a document other than the one that initiated them, causing the requestingUrl passed     to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted     content. An application that grants openExternal based on the requesting origin and allows untrusted     content to open or navigate windows could therefore allow that content to launch an OS-registered external     application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
    (CVE-2026-114121)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
    Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs
    could be attributed to a document other than the one that initiated them, causing the requestingUrl passed
    to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted
    content. An application that grants openExternal based on the requesting origin and allows untrusted
    content to open or navigate windows could therefore allow that content to launch an OS-registered external
    application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
    (CVE-2026-114121)

ID	Name	Product	Family	Type	Severity
378172	Linux Distros Unpatched Vulnerability : CVE-2026-114121	Nessus	Misc.	Local	medium
476850	SCA: security update for electron (GHSA-997q-gvvc-jwmx)	Tenable Cloud Security	SCA Checks	Local	medium
476850	SCA: security update for electron (GHSA-997q-gvvc-jwmx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-114121

medium

Tenable Plugins

medium

medium

medium