Time-of-check Time-of-use (TOCTOU) Race Condition Affecting electron package, versions >=42.0.0-alpha.1 <42.0.0-beta.2>=40.0.0-alpha.2 <41.10.5<39.8.10
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ELECTRON-20335469
- published30 Sept 2026
- disclosed29 Sept 2026
- creditUnknown
Introduced: 29 Sep 2026
NewCVE-2026-102672 (opens in a new tab)How to fix?
Upgrade electron to version 42.0.0-beta.2, 41.10.5, 39.8.10 or higher.
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the Squirrel.Mac installer component (SQRLInstaller), where the target bundle URL read from a serialized request on disk is re-evaluated at multiple points in the install signal chain rather than being resolved once to a canonical path. A local attacker can substitute a symlink between validation and use steps, redirecting a privileged install to an arbitrary location and achieving arbitrary code execution or full compromise of confidentiality, integrity, and availability.
Note: This is only exploitable on macOS in applications that ship Squirrel.Mac-based auto-updates.