Nixpkgs security tracker

Untriaged

Permalink CVE-2026-70609

5.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 3 weeks, 3 days ago Activity log

Created suggestion 3 weeks, 3 days ago

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

References

https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m x_refsource_CONFIRM
https://github.com/electron/electron/pull/50665 x_refsource_MISC
https://github.com/electron/electron/pull/50666 x_refsource_MISC
https://github.com/electron/electron/pull/50667 x_refsource_MISC
https://github.com/electron/electron/pull/50668 x_refsource_MISC
https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1 x_refsource_MISC
https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b x_refsource_MISC
https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce x_refsource_MISC
https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba x_refsource_MISC
https://github.com/electron/electron/releases/tag/v39.8.7 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v40.9.0 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v41.2.0 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v42.0.0-beta.1 x_refsource_MISC

Affected products

electron

==>= 42.0.0-alpha.1, < 42.0.0-beta.1
==>= 41.0.0-alpha.1, < 41.2.0
==>= 40.0.0-alpha.1, < 40.9.0
==< 39.8.7

Matching in nixpkgs

pkgs.electron

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.electron-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-cash

Bitcoin Cash SPV Wallet

nixos-unstable 4.4.2
- nixpkgs-unstable 4.4.2
- nixos-unstable-small 4.4.2
nixos-26.05 4.4.2
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.4.2

pkgs.electron-mail

Unofficial Election-based ProtonMail desktop client

nixos-unstable 5.3.7
- nixpkgs-unstable 5.3.8
- nixos-unstable-small 5.3.8
nixos-26.05 5.3.7
- nixos-26.05-small 5.3.8
- nixpkgs-26.05-darwin 5.3.8

pkgs.electron-fiddle

Easiest way to get started with Electron

nixos-unstable 0.37.2
- nixpkgs-unstable 0.37.2
- nixos-unstable-small 0.37.2
nixos-26.05 0.37.2
- nixos-26.05-small 0.37.2
- nixpkgs-26.05-darwin 0.37.2

pkgs.electron_38-bin

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39-bin

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40-bin

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42-bin

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43-bin

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.todoist-electron

To-Do List App & Task Manager

nixos-unstable 9.20.0
- nixpkgs-unstable 9.20.0
- nixos-unstable-small 9.20.0
nixos-26.05 9.20.0
- nixos-26.05-small 9.20.0
- nixpkgs-26.05-darwin 9.20.0

pkgs.jitsi-meet-electron

Jitsi Meet desktop application powered by Electron

nixos-unstable 2026.5.0
- nixpkgs-unstable 2026.5.0
- nixos-unstable-small 2026.5.0
nixos-26.05 2026.5.0
- nixos-26.05-small 2026.5.0
- nixpkgs-26.05-darwin 2026.5.0

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.idrisPackages.electron

Electron bindings for Idris

nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07

pkgs.electron-chromedriver_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron-chromedriver_39

WebDriver server for running Selenium tests on Chrome

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron-chromedriver_40

WebDriver server for running Selenium tests on Chrome

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron-chromedriver_41

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-chromedriver_42

WebDriver server for running Selenium tests on Chrome

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron-chromedriver_43

WebDriver server for running Selenium tests on Chrome

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

Package maintainers

@yayayayaka Yaya <github@uwu.is>
@teutat3s teutat3s <teutates@mailbox.org>
@TomaSajt TomaSajt
@oxalica oxalica <oxalicc@pm.me>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
@andersk Anders Kaseorg <andersk@mit.edu>
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
@brainrake Marton Boros <martonboros@gmail.com>
@Lassulus Lassulus <lassulus@gmail.com>
@novmar Marcel Novotny <novotny@marnov.cz>
@ryantm Ryan Mulligan <ryan@ryantm.com>
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
@pokon548 Bu Kun <nix@bukn.uk>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.electron

pkgs.electron_38

pkgs.electron_39

pkgs.electron_40

pkgs.electron_41

pkgs.electron_42

pkgs.electron_43

pkgs.electron-bin

pkgs.electron-cash

pkgs.electron-mail

pkgs.electron-fiddle

pkgs.electron_38-bin

pkgs.electron_39-bin

pkgs.electron_40-bin

pkgs.electron_41-bin

pkgs.electron_42-bin

pkgs.electron_43-bin

pkgs.todoist-electron

pkgs.jitsi-meet-electron

pkgs.electron-chromedriver

pkgs.idrisPackages.electron

pkgs.electron-chromedriver_38

pkgs.electron-chromedriver_39

pkgs.electron-chromedriver_40

pkgs.electron-chromedriver_41

pkgs.electron-chromedriver_42

pkgs.electron-chromedriver_43

Package maintainers