AIKIDO-2026-477020
electron is vulnerable to Race Condition (TOCTOU)
67
Medium Risk
This Affects:
electronTL;DR
Electron bundles the Squirrel.Mac auto-update framework on macOS, and its privileged ShipIt helper performs the final step of an update while running as root. A time-of-check to time-of-use race in that step lets a local process cause ShipIt to overwrite a different application's files as root instead of the app that started the update. Exploitation requires local access to the machine and only affects apps that ship Squirrel.Mac based auto-updates. The fix closes the race so ShipIt operates only on the application that initiated the update.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you ship Squirrel.Mac based auto-updates on macOS.
Background info
electron is vulnerable to Race Condition (TOCTOU) in versions 0.0.1 - 39.8.9 and 40.0.0 - 41.10.4.
How to fix this
Upgrade the electron library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.