ELECTRON · GHSA-22mq-c535-7vv9 · Runtime
FIX → 36.0.0-alpha.5 · 35.1.0
A CommonJS Electron app packaged in an ASAR archive can be prevented from starting by a package.json file in a directory above the app. A local user who can write to an ancestor directory of the install location can stop the app from launching.
first public Oct 15, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Electron 35 and 36 apps whose main-process entry point is CommonJS and that are packaged in an ASAR archive are exposed. The attacker must be a local user able to write to a directory above the app's install location. Apps with ES module entry points are not affected.
Not affected if electron-not-35-or-36, esm-entry-point, non-asar-packaging
Who cares desktop-apps, electron, linux, macos, windows
npm ls electronpackage.json in directories above the install location that is malformed or sets "type": "module"A CommonJS app packaged in an ASAR archive could be prevented from launching by a package.json in a directory above the app, for example one that is malformed or declares "type": "module". Because that file is outside the app's own package, a local user able to write to an ancestor directory of the install location could stop the app from starting.
Apps are only affected on Electron 35 and 36 if their main-process entry point is CommonJS and packaged in an ASAR archive. Apps whose entry point is an ES module are not affected.
There are no app side workarounds, you must update to a patched version of Electron.
36.0.0-alpha.535.1.0If you have any questions or comments about this advisory, email us at security@electronjs.org
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 36.0.0-alpha.5 · 35.1.0
35.1.036.0.0-alpha.5