CVE-2026-102672

6.7Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.7Medium

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-367

Impact

A local attacker can overwrite files of other applications via root-level writes, requiring local access and a user triggering an update. This allows arbitrary code execution or privilege escalation on the local macOS system.

Root cause

A race condition in the privileged ShipIt helper fails to bind the validated update target to a single canonical application-bundle path during installation.

Affected systems

Electron prior to 39.8.10, 41.10.5, and 42.0.0-beta.2 on macOS using Squirrel.Mac auto-updates

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Electron dependencies to 39.8.10, 41.10.5, 42.0.0-beta.2, or later. If patching immediately is not possible, disable Squirrel.Mac-based automatic updates in macOS application builds.

shell

$ npm install electron@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102672