Electron vulnerabilities and fixes

CVEs that mention Electron, ranked by priority. 22 tracked.

Electron has 22 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-10-24. Highest priority: CVE-2026-48056 (score 57/100).

• CVE-2026-48056 CRITICAL 10.0 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-48046 CRITICAL 9.3 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-66395 CRITICAL 9.6 SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin read
• CVE-2026-52877 HIGH 8.3 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-60009 HIGH 8.8 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload
• CVE-2026-66396 HIGH 8.4 SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and
• CVE-2026-61891 HIGH 7.5 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-downlo
• CVE-2026-115570 HIGH 7.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-52875 HIGH 8.4 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-52872 HIGH 8.8 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-52873 MEDIUM 6.9 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-52876 HIGH 8.8 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-113800 MEDIUM 5.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-115929 MEDIUM 6.8 MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store
• CVE-2026-69116 MEDIUM 6.1 FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html d
• CVE-2026-114121 MEDIUM 5.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-114606 MEDIUM 5.6 draw.io Desktop is the official Electron build of draw.io
• CVE-2026-113797 LOW 3.1 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-113798 MEDIUM 5.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-113796 MEDIUM 4.2 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-114124 LOW 3.9 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-114122 LOW 3.9 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS

FAQ

How do I fix Electron vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Electron being exploited right now?

None of the tracked Electron CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Electron CVE should I patch first?

CVE-2026-48056 currently ranks highest (57/100): Streambert is a cross-platform Electron Desktop App to stream and download video content.

← Back to latest CVEs