{
  "schema_version": 1,
  "app_id": "io.thepeoples.ProtonPass",
  "slug": "proton-pass",
  "version": "1.41.1",
  "scanned_at": "2026-10-06T06:51:21Z",
  "scanner": {
    "name": "trivy",
    "version": "0.73.0",
    "db_updated_at": "2026-10-06T01:08:27Z"
  },
  "input": {
    "kind": "rpm",
    "filename": "proton-pass-1.41.1-1.x86_64.rpm",
    "sha256": "d01741b2dc5e6439342fea588279c9c7864bf4afd6a163a2185d0c8f73ade9de",
    "extracted_without_scripts": true
  },
  "gate": {
    "result": "pass",
    "fail_on": "wrap CRITICAL"
  },
  "counts": {
    "wrap": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    },
    "vendor": {
      "critical": 0,
      "high": 4,
      "medium": 0,
      "low": 0,
      "unknown": 0
    }
  },
  "coverage": {
    "packages_seen": 10,
    "wrap": {
      "status": "inventoried",
      "packages_seen": 0,
      "notes": []
    },
    "vendor": {
      "status": "inventoried",
      "packages_seen": 10,
      "notes": [
        "electron asar",
        "package.json uses yarn workspace protocol",
        "electron 39.8.10 from version file",
        "electron 39.8.10 from package.json",
        "skipped workspace protocol package.json deps",
        "read 1 package.json file(s)",
        "trivy sbom on 10 derived PURLs"
      ]
    }
  },
  "findings": [
    {
      "id": "CVE-2026-102673",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.10",
      "fixed": "41.10.4, 42.5.2, 43.0.0",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popups opened from sandboxed iframes"
    },
    {
      "id": "CVE-2026-102674",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.10",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popup window creation"
    },
    {
      "id": "CVE-2026-102675",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.10",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers"
    },
    {
      "id": "CVE-2026-102676",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.10",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: electron: Privilege escalation via unauthorized Node.js integration in web workers"
    }
  ]
}