{
  "schema_version": 1,
  "app_id": "io.thepeoples.T3Code",
  "slug": "t3-code",
  "version": "0.0.37",
  "scanned_at": "2026-09-02T04:58:49Z",
  "scanner": {
    "name": "trivy",
    "version": "0.73.0",
    "db_updated_at": "2026-09-01T19:20:44Z"
  },
  "input": {
    "kind": "appimage",
    "filename": "T3-Code-0.0.37-x86_64.AppImage",
    "sha256": "ea88807ccc4b18b2c3f85726ef1235e695b656ab37c8e29c9289f7a28de336c2",
    "extracted_without_scripts": true
  },
  "gate": {
    "result": "pass",
    "fail_on": "wrap CRITICAL"
  },
  "counts": {
    "wrap": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    },
    "vendor": {
      "critical": 0,
      "high": 28,
      "medium": 65,
      "low": 15,
      "unknown": 0
    }
  },
  "coverage": {
    "packages_seen": 233,
    "wrap": {
      "status": "inventoried",
      "packages_seen": 0,
      "notes": []
    },
    "vendor": {
      "status": "inventoried",
      "packages_seen": 233,
      "notes": [
        "electron asar",
        "electron 39.8.5 from package.json",
        "electron 12.0.4 from package.json",
        "electron 39.2.6 from package.json",
        "read 311 package.json file(s)",
        "trivy sbom on 233 derived PURLs"
      ]
    }
  },
  "findings": [
    {
      "id": "CVE-2021-39184",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "11.5.0, 12.1.0, 13.3.0",
      "class": "vendor",
      "title": "Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API"
    },
    {
      "id": "CVE-2022-21718",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "13.6.6, 14.2.4, 15.3.5, 16.0.6, 17.0.0-alpha.6",
      "class": "vendor",
      "title": "Renderers can obtain access to random bluetooth device without permission in Electron"
    },
    {
      "id": "CVE-2022-25883",
      "severity": "HIGH",
      "pkg": "semver",
      "installed": "7.3.5",
      "fixed": "7.5.2, 6.3.1, 5.7.2",
      "class": "vendor",
      "title": "nodejs-semver: Regular expression denial of service"
    },
    {
      "id": "CVE-2022-29247",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "15.5.5, 16.2.6, 17.2.0, 18.0.0-beta.6",
      "class": "vendor",
      "title": "Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled"
    },
    {
      "id": "CVE-2022-29257",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "15.5.0, 16.2.0, 17.2.0, 18.0.0-beta.6",
      "class": "vendor",
      "title": "AutoUpdater module fails to validate certain nested components of the bundle"
    },
    {
      "id": "CVE-2022-36077",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "18.3.7, 20.0.1, 19.0.11",
      "class": "vendor",
      "title": "Electron: Redirection error and misuse of hashed credentials"
    },
    {
      "id": "CVE-2023-29198",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "22.3.6, 23.2.3, 24.0.1, 25.0.0-alpha.2",
      "class": "vendor",
      "title": "Electron context isolation bypass via nested unserializable return value"
    },
    {
      "id": "CVE-2023-39956",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "22.3.19, 23.3.13, 24.7.1, 25.5.0, 26.0.0-beta.13",
      "class": "vendor",
      "title": "Electron vulnerable to out-of-package code execution when launched with arbitrary cwd"
    },
    {
      "id": "CVE-2023-44402",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "22.3.24, 24.8.3, 25.8.1, 26.2.1, 27.0.0-alpha.7",
      "class": "vendor",
      "title": "ASAR Integrity bypass via filetype confusion in electron"
    },
    {
      "id": "CVE-2023-5217",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8",
      "class": "vendor",
      "title": "libvpx: Heap buffer overflow in vp8 encoding in libvpx"
    },
    {
      "id": "CVE-2024-46993",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "28.3.2, 29.3.3, 30.0.3",
      "class": "vendor",
      "title": "Electron vulnerable to Heap Buffer Overflow in NativeImage"
    },
    {
      "id": "CVE-2025-55305",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6",
      "class": "vendor",
      "title": "electron: ASAR Integrity Bypass via resource modification"
    },
    {
      "id": "CVE-2025-64718",
      "severity": "MEDIUM",
      "pkg": "js-yaml",
      "installed": "4.1.0",
      "fixed": "4.1.1, 3.14.2",
      "class": "vendor",
      "title": "js-yaml: js-yaml prototype pollution in merge"
    },
    {
      "id": "CVE-2025-66400",
      "severity": "MEDIUM",
      "pkg": "mdast-util-to-hast",
      "installed": "13.0.0",
      "fixed": "13.2.1",
      "class": "vendor",
      "title": "mdast-util-to-hast: mdast-util-to-hast: Markdown code elements can appear as regular page content"
    },
    {
      "id": "CVE-2025-69873",
      "severity": "MEDIUM",
      "pkg": "ajv",
      "installed": "8.0.0",
      "fixed": "8.18.0, 6.14.0",
      "class": "vendor",
      "title": "ajv: ReDoS via $data reference"
    },
    {
      "id": "CVE-2025-69873",
      "severity": "MEDIUM",
      "pkg": "ajv",
      "installed": "8.6.3",
      "fixed": "8.18.0, 6.14.0",
      "class": "vendor",
      "title": "ajv: ReDoS via $data reference"
    },
    {
      "id": "CVE-2026-13676",
      "severity": "HIGH",
      "pkg": "fast-uri",
      "installed": "3.0.1",
      "fixed": "4.0.1, 3.1.3, 2.4.2",
      "class": "vendor",
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "id": "CVE-2026-13697",
      "severity": "HIGH",
      "pkg": "undici",
      "installed": "8.7.0",
      "fixed": "7.29.0, 8.9.0",
      "class": "vendor",
      "title": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives"
    },
    {
      "id": "CVE-2026-14643",
      "severity": "MEDIUM",
      "pkg": "undici",
      "installed": "8.7.0",
      "fixed": "7.29.0, 8.9.0",
      "class": "vendor",
      "title": "undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing"
    },
    {
      "id": "CVE-2026-15157",
      "severity": "MEDIUM",
      "pkg": "undici",
      "installed": "8.7.0",
      "fixed": "6.28.0, 7.29.0, 8.9.0",
      "class": "vendor",
      "title": "undici: undici: HTTP header injection via unvalidated blob-like body type property"
    },
    {
      "id": "CVE-2026-16221",
      "severity": "HIGH",
      "pkg": "fast-uri",
      "installed": "3.0.1",
      "fixed": "2.4.3, 3.1.4, 4.1.1",
      "class": "vendor",
      "title": "fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency"
    },
    {
      "id": "CVE-2026-16728",
      "severity": "MEDIUM",
      "pkg": "undici",
      "installed": "8.7.0",
      "fixed": "6.28.0, 7.29.0, 8.9.0",
      "class": "vendor",
      "title": "undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length"
    },
    {
      "id": "CVE-2026-16729",
      "severity": "MEDIUM",
      "pkg": "undici",
      "installed": "8.7.0",
      "fixed": "6.28.0, 7.29.0, 8.9.0",
      "class": "vendor",
      "title": "undici: Undici: Cookie attribute injection allows bypassing security protections"
    },
    {
      "id": "CVE-2026-18446",
      "severity": "HIGH",
      "pkg": "fast-uri",
      "installed": "3.0.1",
      "fixed": "2.4.4, 3.1.5, 4.1.2",
      "class": "vendor",
      "title": "fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority"
    },
    {
      "id": "CVE-2026-34764",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures."
    },
    {
      "id": "CVE-2026-34765",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling"
    },
    {
      "id": "CVE-2026-34765",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling"
    },
    {
      "id": "CVE-2026-34766",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass"
    },
    {
      "id": "CVE-2026-34766",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass"
    },
    {
      "id": "CVE-2026-34767",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.3, 40.8.3, 41.0.3",
      "class": "vendor",
      "title": "electron: Electron: HTTP Response Header Injection via attacker-controlled input"
    },
    {
      "id": "CVE-2026-34767",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.3, 40.8.3, 41.0.3",
      "class": "vendor",
      "title": "electron: Electron: HTTP Response Header Injection via attacker-controlled input"
    },
    {
      "id": "CVE-2026-34768",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution via unquoted path in Run registry key"
    },
    {
      "id": "CVE-2026-34768",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution via unquoted path in Run registry key"
    },
    {
      "id": "CVE-2026-34769",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches"
    },
    {
      "id": "CVE-2026-34769",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches"
    },
    {
      "id": "CVE-2026-34770",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Use-after-free in PowerMonitor on Windows and macOS"
    },
    {
      "id": "CVE-2026-34770",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Use-after-free in PowerMonitor on Windows and macOS"
    },
    {
      "id": "CVE-2026-34771",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Memory corruption or application crash via use-after-free in permission request handling"
    },
    {
      "id": "CVE-2026-34771",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Memory corruption or application crash via use-after-free in permission request handling"
    },
    {
      "id": "CVE-2026-34772",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7",
      "class": "vendor",
      "title": "Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash"
    },
    {
      "id": "CVE-2026-34772",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7",
      "class": "vendor",
      "title": "Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash"
    },
    {
      "id": "CVE-2026-34773",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "electron: Electron: Protocol handler hijacking via improper validation of protocol names"
    },
    {
      "id": "CVE-2026-34773",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "electron: Electron: Protocol handler hijacking via improper validation of protocol names"
    },
    {
      "id": "CVE-2026-34774",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.1, 40.7.0, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering"
    },
    {
      "id": "CVE-2026-34774",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.1, 40.7.0, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering"
    },
    {
      "id": "CVE-2026-34775",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.4, 40.8.4, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping"
    },
    {
      "id": "CVE-2026-34775",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.4, 40.8.4, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping"
    },
    {
      "id": "CVE-2026-34776",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Information disclosure via crafted second-instance message"
    },
    {
      "id": "CVE-2026-34776",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Information disclosure via crafted second-instance message"
    },
    {
      "id": "CVE-2026-34777",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin"
    },
    {
      "id": "CVE-2026-34777",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin"
    },
    {
      "id": "CVE-2026-34778",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker"
    },
    {
      "id": "CVE-2026-34778",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker"
    },
    {
      "id": "CVE-2026-34779",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: AppleScript injection in app.moveToApplicationsFolder on macOS"
    },
    {
      "id": "CVE-2026-34779",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: AppleScript injection in app.moveToApplicationsFolder on macOS"
    },
    {
      "id": "CVE-2026-34780",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Context Isolation bypass via VideoFrame object transfer"
    },
    {
      "id": "CVE-2026-34781",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Denial of Service via malformed clipboard image data"
    },
    {
      "id": "CVE-2026-34781",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Denial of Service via malformed clipboard image data"
    },
    {
      "id": "CVE-2026-53550",
      "severity": "MEDIUM",
      "pkg": "js-yaml",
      "installed": "4.1.0",
      "fixed": "4.2.0, 3.15.0",
      "class": "vendor",
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys"
    },
    {
      "id": "CVE-2026-59869",
      "severity": "HIGH",
      "pkg": "js-yaml",
      "installed": "4.1.0",
      "fixed": "3.15.0, 4.3.0",
      "class": "vendor",
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "id": "CVE-2026-6321",
      "severity": "HIGH",
      "pkg": "fast-uri",
      "installed": "3.0.1",
      "fixed": "3.1.1, 2.4.1",
      "class": "vendor",
      "title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies"
    },
    {
      "id": "CVE-2026-6322",
      "severity": "HIGH",
      "pkg": "fast-uri",
      "installed": "3.0.1",
      "fixed": "3.1.2, 2.4.1",
      "class": "vendor",
      "title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "12.0.4",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.2.6",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    },
    {
      "id": "GHSA-5p4m-2wfm-xmqj",
      "severity": "HIGH",
      "pkg": "js-yaml",
      "installed": "4.1.0",
      "fixed": "4.3.1, 3.15.1",
      "class": "vendor",
      "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"
    }
  ]
}