Nixpkgs security tracker

Dismissed

Permalink CVE-2026-70597

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 2 weeks ago
@LeSuisse ignored
26 packages
- electron
- electron_38
- electron_39
- electron_40
- electron_41
- electron_42
- electron_43
- electron-bin
- electron-cash
- electron-mail
- electron-fiddle
- electron_39-bin
- electron_40-bin
- electron_41-bin
- electron_42-bin
- electron_43-bin
- todoist-electron
- jitsi-meet-electron
- electron-chromedriver
- idrisPackages.electron
- electron-chromedriver_38
- electron-chromedriver_39
- electron-chromedriver_40
- electron-chromedriver_41
- electron-chromedriver_42
- electron-chromedriver_43
1 month, 2 weeks ago
@LeSuisse restored package electron_38 1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse dismissed 1 month, 2 weeks ago

Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

References

https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx x_refsource_CONFIRM
https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35 x_refsource_MISC

Affected products

electron

==>= 40.0.0-alpha.1, < 40.9.0
==>= 41.0.0-alpha.1, < 41.2.1
==< 39.8.8
==>= 42.0.0-alpha.1, < 42.0.0-beta.3

Matching in nixpkgs

pkgs.electron_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_38-bin

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

Ignored packages (25)

pkgs.electron

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_39

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.electron-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-cash

Bitcoin Cash SPV Wallet

nixos-unstable 4.4.2
- nixpkgs-unstable 4.4.2
- nixos-unstable-small 4.4.2
nixos-26.05 4.4.2
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.4.2

pkgs.electron-mail

Unofficial Election-based ProtonMail desktop client

nixos-unstable 5.3.7
- nixpkgs-unstable 5.3.7
- nixos-unstable-small 5.3.8
nixos-26.05 5.3.7
- nixos-26.05-small 5.3.8
- nixpkgs-26.05-darwin 5.3.7

pkgs.electron-fiddle

Easiest way to get started with Electron

nixos-unstable 0.37.2
- nixpkgs-unstable 0.37.2
- nixos-unstable-small 0.37.2
nixos-26.05 0.37.2
- nixos-26.05-small 0.37.2
- nixpkgs-26.05-darwin 0.37.2

pkgs.electron_39-bin

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40-bin

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42-bin

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43-bin

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.todoist-electron

To-Do List App & Task Manager

nixos-unstable 9.20.0
- nixpkgs-unstable 9.20.0
- nixos-unstable-small 9.20.0
nixos-26.05 9.20.0
- nixos-26.05-small 9.20.0
- nixpkgs-26.05-darwin 9.20.0

pkgs.jitsi-meet-electron

Jitsi Meet desktop application powered by Electron

nixos-unstable 2026.5.0
- nixpkgs-unstable 2026.5.0
- nixos-unstable-small 2026.5.0
nixos-26.05 2026.5.0
- nixos-26.05-small 2026.5.0
- nixpkgs-26.05-darwin 2026.5.0

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.idrisPackages.electron

Electron bindings for Idris

nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07

pkgs.electron-chromedriver_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron-chromedriver_39

WebDriver server for running Selenium tests on Chrome

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron-chromedriver_40

WebDriver server for running Selenium tests on Chrome

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron-chromedriver_41

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-chromedriver_42

WebDriver server for running Selenium tests on Chrome

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron-chromedriver_43

WebDriver server for running Selenium tests on Chrome

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

All supported versions have been updated

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.electron_38

pkgs.electron_38-bin

pkgs.electron

pkgs.electron_39

pkgs.electron_40

pkgs.electron_41

pkgs.electron_42

pkgs.electron_43

pkgs.electron-bin

pkgs.electron-cash

pkgs.electron-mail

pkgs.electron-fiddle

pkgs.electron_39-bin

pkgs.electron_40-bin

pkgs.electron_41-bin

pkgs.electron_42-bin

pkgs.electron_43-bin

pkgs.todoist-electron

pkgs.jitsi-meet-electron

pkgs.electron-chromedriver

pkgs.idrisPackages.electron

pkgs.electron-chromedriver_38

pkgs.electron-chromedriver_39

pkgs.electron-chromedriver_40

pkgs.electron-chromedriver_41

pkgs.electron-chromedriver_42

pkgs.electron-chromedriver_43