Security advisories

medium2026-04-03

CVE-2026-34778-Electron: Service worker can spoof executeJavaScript IPC replies

electron/electron · GHSA-xj5x-m3f3-5x3h

medium2026-04-03

CVE-2026-34777-Electron: Incorrect origin passed to permission request handler for iframe requests

electron/electron · GHSA-r5p7-gp4j-qhrx

medium2026-04-03

CVE-2026-34776-Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

electron/electron · GHSA-3c8v-cfp5-9885

medium2026-04-03

CVE-2026-34775-Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

electron/electron · GHSA-xwr5-m59h-vwqr

high2026-04-03

CVE-2026-34774-Electron: Use-after-free in offscreen child window paint callback

electron/electron · GHSA-532v-xpq5-8h95

medium2026-04-03

CVE-2026-34773-Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

electron/electron · GHSA-mwmh-mq4g-g6gr

medium2026-04-03

CVE-2026-34772-Electron: Use-after-free in download save dialog callback

electron/electron · GHSA-9w97-2464-8783

high2026-04-03

CVE-2026-34771-Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

electron/electron · GHSA-8337-3p73-46f4

high2026-04-03

CVE-2026-34770-Electron: Use-after-free in PowerMonitor on Windows and macOS

electron/electron · GHSA-jjp3-mq3x-295m

high2026-04-03

CVE-2026-34769-Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

electron/electron · GHSA-9wfr-w7mm-pc7f

low2026-04-03

CVE-2026-34768-Electron: Unquoted executable path in app.setLoginItemSettings on Windows

electron/electron · GHSA-jfqx-fxh3-c62j

medium2026-04-03

CVE-2026-34767-Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

electron/electron · GHSA-4p4r-m79c-wq3v

low2026-04-03

CVE-2026-34766-Electron: USB device selection not validated against filtered device list

electron/electron · GHSA-9899-m83m-qhpj

low2026-04-02

CVE-2026-47099-TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`

storybookjs/telejson · GHSA-ccgf-5rwj-j3hv

low2026-04-02

CVE-2026-41377-OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

openclaw/openclaw · GHSA-cwq8-6f96-g3q4

high2026-04-02

CVE-2026-41364-OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host

openclaw/openclaw · GHSA-fv94-qvg8-xqpw

medium2026-04-02

CVE-2026-41302-OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery

openclaw/openclaw · GHSA-9q7v-8mr7-g23p

medium2026-04-02

OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

openclaw/openclaw · GHSA-j9pv-rrcj-6pfx

low2026-04-02

CVE-2026-41365-OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

openclaw/openclaw · GHSA-chfm-xgc4-47rj

medium2026-04-02

CVE-2026-41343-OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

openclaw/openclaw · GHSA-qcc3-jqwp-5vh2