AIKIDO-2026-477020
electron is vulnerable to Race Condition (TOCTOU)
67
CVE Score
Medium
Race Condition (TOCTOU)
TL;DR
Electron bundles the Squirrel.Mac auto-update framework on macOS, and its privileged ShipIt helper performs the final step of an update while running as root. A time-of-check to time-of-use race in that step lets a local process cause ShipIt to overwrite a different application's files as root instead of the app that started the update. Exploitation requires local access to the machine and only affects apps that ship Squirrel.Mac based auto-updates. The fix closes the race so ShipIt operates only on the application that initiated the update.
How do I fix this?
Upgrade the electron library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you ship Squirrel.Mac based auto-updates on macOS.
Package
Versions
0.0.1 - 39.8.9
Fixed in 39.8.1040.0.0 - 41.10.4
Fixed in 41.10.5Background info
electron is vulnerable to Race Condition (TOCTOU) in versions 0.0.1 - 39.8.9 and 40.0.0 - 41.10.4.
Links
GitHub Releases
github.com/electron/electron/releases/tag/v41.10.5github.com/electron/electron/releases/tag/v39.8.10github.com/electron/electron/releases/tag/v42.0.0-beta.2Fix Commits
github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cefgithub.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.