5.4

CVE-2026-34766

Electron: USB device selection not validated against filtered device list

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters. The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron SwPlatform node.js Version < 38.8.6
Electronjs ≫ Electron SwPlatform node.js Version >= 39.0.0 < 39.8.0
Electronjs ≫ Electron SwPlatform node.js Version >= 40.0.0 < 40.7.0
Electronjs ≫ Electron Version 41.0.0 Update alpha1 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update alpha2 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update alpha3 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update alpha4 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update alpha5 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update alpha6 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta1 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta2 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta3 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta4 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta5 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta6 SwPlatform node.js
Electronjs ≫ Electron Version 41.0.0 Update beta7 SwPlatform node.js
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.057
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
security-advisories@github.com 3.3 0.8 2.5
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
Vendor Advisory