{"id":"ghsa-ghsa-997q-gvvc-jwmx","seq":309561,"kind":"advisory","title":"Electron: openExternal permission requests can be attributed to the wrong origin","url":"https://github.com/advisories/GHSA-997q-gvvc-jwmx","permalink":"https://vulnpulse.app/items/ghsa-ghsa-997q-gvvc-jwmx","summary":"影響: npm:electron < 42.11.3 → 42.11.3, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5\nRequests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application. Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose…","severity":"medium","techs":["nodejs","electron"],"cves":["CVE-2026-114121"],"tags":["GHSA-997q-gvvc-jwmx","electron","electron","electron","electron"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:43:59.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}