Node.js CVE-2026-34775

The CVSS 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates network-accessible vulnerability requiring high attack complexity, user interaction, and no privileges-typical of browser-based attacks requiring social engineering or user click-through. Confidentiality and integrity are high-impact (information disclosure and code execution possible), but availability is not affected. The attack complexity is elevated, partially mitigating the risk; an attacker must craft a specific multi-frame configuration and trigger worker creation in a precisely scoped context. Critically, this vulnerability is opt-in-only applications that explicitly enable nodeIntegrationInWorker are vulnerable, significantly reducing real-world surface area. The requirement for user interaction (UI:R) further constrains practical exploitability. No public exploit code or active exploitation (KEV status) has been identified, and the complexity of the attack scenario suggests this is a lower-priority issue compared to simpler remote code execution vectors, despite the elevated CVSS score.

An attacker could craft a malicious website that, when loaded by an Electron application with nodeIntegrationInWorker enabled, creates a child frame with nodeIntegrationInWorker: false and then spawns a Web Worker from that frame. Due to the scoping flaw, the worker would unexpectedly receive Node.js integration, allowing the attacker to execute arbitrary Node.js code and access the local filesystem, system processes, or other privileged operations. This requires the user to navigate to or be socially engineered into visiting the malicious site within a vulnerable Electron application. No public exploit code has been identified.