cyfenced.com →

[ CVE-2026-102672 · Published 13 Oct 2026 ]

Electron: Local race condition in Squirrel.Mac update installation on macOS

CVSS 6.7 EPSS <1%Fix available

[ Description ]Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.

[ Fixes ]Fixes and patches

  • electron 39.8.10Fixed version · GitHub Advisories · npm package electron: upgrade to 39.8.10 or later (affected < 39.8.10)
  • electron 41.10.5Fixed version · GitHub Advisories · npm package electron: upgrade to 41.10.5 or later (affected >= 40.0.0-alpha.1, < 41.10.5)
  • electron 42.0.0-beta.2Fixed version · GitHub Advisories · npm package electron: upgrade to 42.0.0-beta.2 or later (affected >= 42.0.0-alpha.1, < 42.0.0-beta.2)

[ Packages ]Affected open-source packages

[ References ]References