What is the CVSS score of CVE-2026-34775?

CVE-2026-34775 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34775?

Yes, a patch is available for CVE-2026-34775. Update the affected software to the latest version immediately.

Node.js CVE-2026-34775

MEDIUM

Improper Isolation or Compartmentalization (CWE-653)

2026-04-03 https://github.com/electron/electron

GHSA-xwr5-m59h-vwqr

Node.js Information Disclosure Microsoft

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Red Hat

6.8 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 03, 2026 - 08:30 nvd

Patch available

Analysis Generated

Apr 03, 2026 - 02:45 vuln.today

CVE Published

Apr 03, 2026 - 02:43 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

Impact

The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds

Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions

41.0.0
40.8.4
39.8.4
38.8.6

For more information

If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)

AnalysisAI

Electron's nodeIntegrationInWorker webPreference fails to properly isolate Node.js integration in worker contexts across certain process-sharing configurations, allowing workers in frames explicitly configured with nodeIntegrationInWorker: false to unexpectedly gain Node.js capabilities. Only applications that explicitly enable nodeIntegrationInWorker are affected. The vulnerability carries a CVSS score of 6.8 and permits information disclosure and code execution in affected contexts, with no public exploit identified at time of analysis.

Technical ContextAI

Electron is a framework for building cross-platform desktop applications using web technologies (Chromium and Node.js). The nodeIntegrationInWorker webPreference controls whether Web Workers spawned within a renderer process have access to Node.js APIs. The vulnerability exists in the scoping mechanism that enforces this security boundary; when multiple frames with differing webPreferences are managed in a shared process context, the isolation logic fails to correctly propagate the nodeIntegrationInWorker: false setting to worker threads. This is fundamentally a CWE-653 (Insufficient Compartmentalization) issue-the security boundary between sandboxed and non-sandboxed execution contexts is not adequately enforced. The affected npm package is electron across versions prior to 41.0.0, 40.8.4, 39.8.4, and 38.8.6.

RemediationAI

Vendor-released patch: Electron 41.0.0, 40.8.4, 39.8.4, or 38.8.6 depending on the currently deployed major version. Application maintainers should upgrade to the corresponding patched version immediately. For applications unable to upgrade immediately, the primary workaround is to avoid enabling nodeIntegrationInWorker in applications that also open child windows or embed external content with differing webPreferences; alternatively, ensure all frames within a shared process have identical webPreferences configurations. Consult the GitHub security advisory at https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr for detailed remediation guidance and version-specific upgrade paths.