CVE-2026-115570

CVSS 7.4 HIGH

Electron: Mitigation for compromised eMudhra intermediate certificates

Mã khác: GHSA-jr5w-w6x2-84p9
Công bố: 2026-10-24
Cập nhật: 2026-10-24
Lần đầu thấy: 2026-10-30
Nguồn: GitHub Advisory

Mô tả

Impact

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.

Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

45.0.0-beta.6
44.9.1
43.8.1
42.11.16

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Điểm và phân loại

CVSS: 7.4 HIGH v3.1
Nguồn điểm: GitHub Advisory
Mức độ (theo nguồn): HIGH
EPSS: 0.38%
CWE: CWE-299

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Ảnh hưởng

Package	Bản bị ảnh hưởng	Bản đã sửa
npm `electron`	`>= 45.0.0-alpha.1, < 45.0.0-beta.6`	`45.0.0-beta.6`
npm `electron`	`>= 44.0.0-alpha.1, < 44.9.1`	`44.9.1`
npm `electron`	`>= 43.0.0-alpha.1, < 43.8.1`	`43.8.1`
npm `electron`	`< 42.11.16`	`42.11.16`