Summary
Electron: Local race condition in Squirrel.Mac update installation on macOS
Advisory details
Impact
On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.
Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
42.0.0-beta.241.10.539.8.10
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
References
- https://github.com/advisories/GHSA-vv43-5jgx-7qv8
- https://github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8
- https://github.com/electron/electron/pull/50745
- https://github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9
- https://github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cef
- https://github.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767
- https://github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be
- https://github.com/electron/electron/releases/tag/v39.8.10
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-102832
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
- HIGHCVE-2026-60091
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
- HIGHCVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
- MEDIUMCVE-2026-105743
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
- HIGHCVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
- MEDIUMCVE-2026-105647
Ghost: Server-Side Request Forgery in Bookmark Fetching