< Back

CVE-2026-102672

Updated on 13 Oct 2026

Severity

6.7 Medium severity

Details

CVSS score
6.7
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Impact

On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application’s files, as root, instead of the app that started the update. Exploitation requires local access to the machine.

Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 42.0.0-beta.2
  • 41.10.5
  • 39.8.10

For more information

If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

Details

Affected product:
React , Vue , clerk-electron , electron , expo-electron-adapter , mongodb-data-service , mongodb-js-compass-electron-menu , mongodb-js-compass-utils , mongodb-js-connection-form , mongodb-js-connection-info , octanejs-electron , remote
Affected packages:
electron @ 23.1.2 (+116 more)

Fixes