Detections
Analytics

SCA: security update for electron (GHSA-x562-297c-g43g)

medium Tenable Self-Hosted Container Security Plugin ID 476848

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
 Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some
 cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's
 requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds
 untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the
 permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded
 content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.
 (CVE-2026-113798)

Solution

Update the electron library and its related packages to version 42.11.9 or later.

See Also

https://github.com/advisories/GHSA-x562-297c-g43g

Plugin Details

Severity: Medium

ID: 476848

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 8.25

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-113798

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-113798

cwe: CWE-346