Detections
Analytics

SCA: security update for electron (GHSA-ff2p-hmqr-hxm4)

medium Tenable Self-Hosted Container Security Plugin ID 445708

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
 Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from
 untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks
 against preload code despite context isolation being enabled. Apps are only affected if their preload code
 accepts object arguments from untrusted content and reads properties from them without own-property
 checks, while apps that only accept primitive arguments or validate object arguments are not affected.
 This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. (CVE-2026-70610)

Solution

Update the electron library and its related packages to version 39.8.9 or later.

See Also

https://github.com/advisories/GHSA-ff2p-hmqr-hxm4

Plugin Details

Severity: Medium

ID: 445708

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/5/2026

Updated: 8/5/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-70610

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/5/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-70610