Detections
Analytics

SCA: security update for electron (GHSA-9wfr-w7mm-pc7f)

high Tenable Cloud Security Plugin ID 439792

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
 Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches
 webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that
 construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker
 to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if
 they construct webPreferences from external or untrusted input without an allowlist. Apps that use a
 fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6,
 39.8.0, 40.7.0, and 41.0.0-beta.8. (CVE-2026-34769)

Solution

Update the electron library and its related packages to version 38.8.6 or later.

See Also

https://github.com/advisories/GHSA-9wfr-w7mm-pc7f

Plugin Details

Severity: High

ID: 439792

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 4/3/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.48

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-34769

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/3/2026

Vulnerability Publication Date: 4/3/2026

Reference Information

CVE: CVE-2026-34769