Detections
Analytics

SCA: security update for electron (GHSA-997q-gvvc-jwmx)

medium Tenable Cloud Security Plugin ID 476850

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
 Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs
 could be attributed to a document other than the one that initiated them, causing the requestingUrl passed
 to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted
 content. An application that grants openExternal based on the requesting origin and allows untrusted
 content to open or navigate windows could therefore allow that content to launch an OS-registered external
 application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
 (CVE-2026-114121)

Solution

Update the electron library and its related packages to version 42.11.3 or later.

See Also

https://github.com/advisories/GHSA-997q-gvvc-jwmx

Plugin Details

Severity: Medium

ID: 476850

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 10.26

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-114121

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-114121

cwe: CWE-346