Nixpkgs security tracker

Untriaged

Permalink CVE-2026-70607

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 2 weeks, 3 days ago Activity log

Created suggestion 2 weeks, 3 days ago

Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

References

https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj x_refsource_CONFIRM
https://github.com/electron/electron/pull/50946 x_refsource_MISC
https://github.com/electron/electron/pull/50947 x_refsource_MISC
https://github.com/electron/electron/pull/50948 x_refsource_MISC
https://github.com/electron/electron/pull/50949 x_refsource_MISC
https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a x_refsource_MISC
https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7 x_refsource_MISC
https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b x_refsource_MISC
https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v39.8.8 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v40.9.0 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v41.2.1 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v42.0.0-beta.3 x_refsource_MISC

Affected products

electron

==>= 40.0.0-alpha.1, < 40.9.0
==>= 41.0.0-alpha.1, < 41.2.1
==>= 42.0.0-alpha.1, < 42.0.0-beta.3
==< 39.8.8

Matching in nixpkgs

pkgs.electron

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.electron-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-cash

Bitcoin Cash SPV Wallet

nixos-unstable 4.4.2
- nixpkgs-unstable 4.4.2
- nixos-unstable-small 4.4.2
nixos-26.05 4.4.2
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.4.2

pkgs.electron-mail

Unofficial Election-based ProtonMail desktop client

nixos-unstable 5.3.7
- nixpkgs-unstable 5.3.7
- nixos-unstable-small 5.3.8
nixos-26.05 5.3.7
- nixos-26.05-small 5.3.8
- nixpkgs-26.05-darwin 5.3.7

pkgs.electron-fiddle

Easiest way to get started with Electron

nixos-unstable 0.37.2
- nixpkgs-unstable 0.37.2
- nixos-unstable-small 0.37.2
nixos-26.05 0.37.2
- nixos-26.05-small 0.37.2
- nixpkgs-26.05-darwin 0.37.2

pkgs.electron_38-bin

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39-bin

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40-bin

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42-bin

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43-bin

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.todoist-electron

To-Do List App & Task Manager

nixos-unstable 9.20.0
- nixpkgs-unstable 9.20.0
- nixos-unstable-small 9.20.0
nixos-26.05 9.20.0
- nixos-26.05-small 9.20.0
- nixpkgs-26.05-darwin 9.20.0

pkgs.jitsi-meet-electron

Jitsi Meet desktop application powered by Electron

nixos-unstable 2026.5.0
- nixpkgs-unstable 2026.5.0
- nixos-unstable-small 2026.5.0
nixos-26.05 2026.5.0
- nixos-26.05-small 2026.5.0
- nixpkgs-26.05-darwin 2026.5.0

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.idrisPackages.electron

Electron bindings for Idris

nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07

pkgs.electron-chromedriver_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron-chromedriver_39

WebDriver server for running Selenium tests on Chrome

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron-chromedriver_40

WebDriver server for running Selenium tests on Chrome

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron-chromedriver_41

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-chromedriver_42

WebDriver server for running Selenium tests on Chrome

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron-chromedriver_43

WebDriver server for running Selenium tests on Chrome

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

Package maintainers

@TomaSajt TomaSajt
@yayayayaka Yaya <github@uwu.is>
@teutat3s teutat3s <teutates@mailbox.org>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@oxalica oxalica <oxalicc@pm.me>
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
@andersk Anders Kaseorg <andersk@mit.edu>
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
@brainrake Marton Boros <martonboros@gmail.com>
@ryantm Ryan Mulligan <ryan@ryantm.com>
@Lassulus Lassulus <lassulus@gmail.com>
@novmar Marcel Novotny <novotny@marnov.cz>
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
@pokon548 Bu Kun <nix@bukn.uk>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.electron

pkgs.electron_38

pkgs.electron_39

pkgs.electron_40

pkgs.electron_41

pkgs.electron_42

pkgs.electron_43

pkgs.electron-bin

pkgs.electron-cash

pkgs.electron-mail

pkgs.electron-fiddle

pkgs.electron_38-bin

pkgs.electron_39-bin

pkgs.electron_40-bin

pkgs.electron_41-bin

pkgs.electron_42-bin

pkgs.electron_43-bin

pkgs.todoist-electron

pkgs.jitsi-meet-electron

pkgs.electron-chromedriver

pkgs.idrisPackages.electron

pkgs.electron-chromedriver_38

pkgs.electron-chromedriver_39

pkgs.electron-chromedriver_40

pkgs.electron-chromedriver_41

pkgs.electron-chromedriver_42

pkgs.electron-chromedriver_43

Package maintainers