CVE-2026-115570

HighCVSS 7.4/10Last modified Oct 23, 2026

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-299

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-beta.6; >= 44.0.0-alpha.1, < 44.9.1; >= 43.0.0-alpha.1, < 43.8.1; < 42.11.16

References

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1155727.1pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same no CVE-2026-115586.3A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_sa CVE-2026-1155807.1pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table CVE-2026-1155857.1pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference e CVE-2026-1155867.1virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy a CVE-2026-115596.3A vulnerability was detected in CodeAstro Payroll System 1.0. This affects an unknown function of the file /view_account.php. The manipulati CVE-2026-11568.8A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /CVE-2026-115619.8Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soag CVE-2026-115624.3The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authentica CVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a CVE-2026-115649.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy