What is GHSA-xj5x-m3f3-5x3h?

GHSA-xj5x-m3f3-5x3h is a security advisory published by GitHub Security Advisories with Medium severity. Electron: Service worker can spoof executeJavaScript IPC replies

Which CVE IDs does GHSA-xj5x-m3f3-5x3h cover?

GHSA-xj5x-m3f3-5x3h covers the following CVE IDs: CVE-2026-34778. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xj5x-m3f3-5x3h?

GHSA-xj5x-m3f3-5x3h has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-xj5x-m3f3-5x3h?

GHSA-xj5x-m3f3-5x3h affects 4 products, including: npm/electron:\u003c 38.8.6; npm/electron:\u003e= 39.0.0-alpha.1, \u003c 39.8.1; npm/electron:\u003e= 40.0.0-alpha.1, \u003c 40.8.1; npm/electron:\u003e= 41.0.0-alpha.1, \u003c 41.0.0.

GHSA-xj5x-m3f3-5x3hMediumCVSS 5.9

Electron: Service worker can spoof executeJavaScript IPC replies

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34778 →

📋 Description

Impact

A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions.

Workarounds

Do not trust the return value of webContents.executeJavaScript() for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

Fixed Versions

41.0.0
40.8.1
39.8.1
38.8.6

For more information

If there are any questions or comments about this advisory, please email [email protected]

🎯 Affected products4

npm/electron:< 38.8.6
npm/electron:>= 39.0.0-alpha.1, < 39.8.1
npm/electron:>= 40.0.0-alpha.1, < 40.8.1
npm/electron:>= 41.0.0-alpha.1, < 41.0.0