Detections
Analytics
SCA: security update for electron (GHSA-9899-m83m-qhpj)
medium Tenable Cloud Security Plugin ID 439783
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not
validate the chosen device ID against the filtered list that was presented to the handler. An app whose
handler could be influenced to select a device ID outside the filtered set would grant access to a device
that did not match the renderer's requested filters or was listed in exclusionFilters. The WebUSB security
blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected.
The practical impact is limited to apps with unusual device-selection logic. This issue has been patched
in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. (CVE-2026-34766)
Solution
Update the electron library and its related packages to version 38.8.6 or later.See Also
Plugin Details
Severity: Medium
ID: 439783
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 4/3/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.1
Percentile: 53.55
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-34766
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/3/2026
Vulnerability Publication Date: 4/3/2026
Reference Information
CVE: CVE-2026-34766
cwe: CWE-862