{"id":"EUVD-2026-53403","enisaUuid":"97fa7be2-0e98-3eec-96c9-30a06a3e6c60","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","datePublished":"Aug 5, 2026, 3:21:11 PM","dateUpdated":"Aug 6, 2026, 3:55:28 AM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx\nhttps://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35\n","aliases":"CVE-2026-70597\nGHSA-jm7p-cc5g-qwxx\n","assigner":"GitHub_M","epss":0.1,"enisaIdProduct":[{"id":"1056ff77-3164-3427-9da6-bcb0bbfbde2e","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.3"},{"id":"28281a90-e3f4-3f17-8f48-194c8b7ed4c9","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.8"},{"id":"33280b17-f9e0-348c-bfde-ee419f7a7b7b","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"},{"id":"e6cdcbf4-ca25-33bc-9640-175647a27c9d","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.1"}],"enisaIdVendor":[{"id":"7ac6db65-61f1-38a7-9187-5a1e9be9adf3","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"7bbe18de-f914-3310-babb-82df552f4d65","vulnerability":{"id":"CVE-2026-70597","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","datePublished":"Aug 5, 2026, 3:21:11 PM","dateUpdated":"Aug 6, 2026, 3:55:28 AM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx\nhttps://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35\n","enisa_id":"EUVD-2026-53403\n","assigner":"GitHub_M","epss":0.1,"dataProcessed":"Nov 5, 2026, 7:13:15 AM","vulnerabilityProduct":[{"id":"2ee1883e-bee8-311c-a01d-24e3e23697e1","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.3"},{"id":"7b510dfe-0a3f-3554-8a9d-10d97833674d","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"},{"id":"a03b5f95-b15c-3b28-8cbd-2d41421b72fc","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.1"},{"id":"d42f9009-5280-3c61-8a3d-6e9c1d4b1e43","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.8"}],"vulnerabilityVendor":[{"id":"8c93d81d-7699-3923-a22e-d22c6b65f075","vendor":{"name":"electron"}}]}},{"id":"c8161f04-0a9d-315e-babf-eb3fd6bddfb5","vulnerability":{"id":"GHSA-jm7p-cc5g-qwxx","description":"Electron: Parent process code-sign check is spoofable","datePublished":"Aug 5, 2026, 3:21:22 PM","dateUpdated":"Aug 5, 2026, 3:22:41 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx\nhttps://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35\nhttps://github.com/electron/electron\n","enisa_id":"EUVD-2026-53403\n","aliases":"GHSA-jm7p-cc5g-qwxx\nCVE-2026-70597\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}