Detections
Analytics

SCA: security update for electron (GHSA-qmv3-fv6v-rmhq)

high Tenable Self-Hosted Container Security Plugin ID 448491

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
 From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not
 verify that a cached entry matched the preload it was served for. A compromised renderer could write
 attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's
 code in the more privileged preload context. The issue affects applications that load untrusted content.
 This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6. (CVE-2026-102677)

Solution

Update the electron library and its related packages to version 42.10.0 or later.

See Also

https://github.com/advisories/GHSA-qmv3-fv6v-rmhq

Plugin Details

Severity: High

ID: 448491

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/29/2026

Updated: 9/29/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-102677

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-102677