CVE-2026-115570

highpriority · track · 0EPSS 0.004 · 32 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 7.4 · high

Is it mine?

4 products

Check your exposure

Who says so?

1 sources

osv

EPSS · scored 2026-10-27

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-299USCWE-299US

affected products (4)

Products and version ranges known to be affected.

npm electron< 42.11.16osvUSpkg:npm/electron
npm electron43.0.0-alpha.1 → 43.8.1osvUSpkg:npm/electron
npm electron44.0.0-alpha.1 → 44.9.1osvUSpkg:npm/electron
npm electron45.0.0-alpha.1 → 45.0.0-beta.6osvUSpkg:npm/electron

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-jr5w-w6x2-84p9Electron: Mitigation for compromised eMudhra intermediate certificates2026-10-23ghsa · osvUS
### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected. Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470). ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `45.0.0-beta.6` * `44.9.1` * `43.8.1` * `42.11.16` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

sources

Which sources assert this record, and when.

osv NVD CVE.org MITRE

published 2026-10-23modified 2026-10-23

references (13) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan