What is GHSA-xwr5-m59h-vwqr?

GHSA-xwr5-m59h-vwqr is a security advisory published by GitHub Security Advisories with Medium severity. Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Which CVE IDs does GHSA-xwr5-m59h-vwqr cover?

GHSA-xwr5-m59h-vwqr covers the following CVE IDs: CVE-2026-34775. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xwr5-m59h-vwqr?

GHSA-xwr5-m59h-vwqr has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xwr5-m59h-vwqr?

GHSA-xwr5-m59h-vwqr affects 4 products, including: npm/electron:\u003c 38.8.6; npm/electron:\u003e= 39.0.0-alpha.1, \u003c 39.8.4; npm/electron:\u003e= 40.0.0-alpha.1, \u003c 40.8.4; npm/electron:\u003e= 41.0.0-alpha.1, \u003c 41.0.0.

GHSA-xwr5-m59h-vwqrMediumCVSS 6.8

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34775 →

📋 Description

Impact

The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds

Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions

41.0.0
40.8.4
39.8.4
38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

🎯 Affected products4

npm/electron:< 38.8.6
npm/electron:>= 39.0.0-alpha.1, < 39.8.4
npm/electron:>= 40.0.0-alpha.1, < 40.8.4
npm/electron:>= 41.0.0-alpha.1, < 41.0.0