What is the CVSS score of CVE-2026-34775?

CVE-2026-34775 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-34775?

Yes, a patch is available for CVE-2026-34775. Update the affected software to the latest version immediately.

Node.js CVE-2026-34775

CRITICAL

Improper Isolation or Compartmentalization (CWE-653)

2026-04-03 https://github.com/electron/electron

GHSA-xwr5-m59h-vwqr

Node.js Information Disclosure Microsoft

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

6.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 22:23 NVD

MEDIUM CRITICAL

CVSS changed

Jul 24, 2026 - 22:23 NVD

6.8 (MEDIUM) 9.8 (CRITICAL)

Patch released

Apr 03, 2026 - 08:30 nvd

Patch available

Analysis Generated

Apr 03, 2026 - 02:45 vuln.today

CVE Published

Apr 03, 2026 - 02:43 nvd

MEDIUM 6.8

DescriptionNVD

Impact

The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds

Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions

41.0.0
40.8.4
39.8.4
38.8.6

For more information

If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)

AnalysisAI

Electron's nodeIntegrationInWorker webPreference fails to properly isolate Node.js integration in worker contexts across certain process-sharing configurations, allowing workers in frames explicitly configured with nodeIntegrationInWorker: false to unexpectedly gain Node.js capabilities. Only applications that explicitly enable nodeIntegrationInWorker are affected. The vulnerability carries a CVSS score of 6.8 and permits information disclosure and code execution in affected contexts, with no public exploit identified at time of analysis.

Technical ContextAI

Electron is a framework for building cross-platform desktop applications using web technologies (Chromium and Node.js). The nodeIntegrationInWorker webPreference controls whether Web Workers spawned within a renderer process have access to Node.js APIs. The vulnerability exists in the scoping mechanism that enforces this security boundary; when multiple frames with differing webPreferences are managed in a shared process context, the isolation logic fails to correctly propagate the nodeIntegrationInWorker: false setting to worker threads. This is fundamentally a CWE-653 (Insufficient Compartmentalization) issue-the security boundary between sandboxed and non-sandboxed execution contexts is not adequately enforced. The affected npm package is electron across versions prior to 41.0.0, 40.8.4, 39.8.4, and 38.8.6.

RemediationAI

Vendor-released patch: Electron 41.0.0, 40.8.4, 39.8.4, or 38.8.6 depending on the currently deployed major version. Application maintainers should upgrade to the corresponding patched version immediately. For applications unable to upgrade immediately, the primary workaround is to avoid enabling nodeIntegrationInWorker in applications that also open child windows or embed external content with differing webPreferences; alternatively, ensure all frames within a shared process have identical webPreferences configurations. Consult the GitHub security advisory at https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr for detailed remediation guidance and version-specific upgrade paths.