The vulnerability is a race condition in the Squirrel.Mac update mechanism of Electron. The privileged ShipIt helper does not bind the validated update target to a single, canonical application-bundle path, allowing a local attacker to redirect a root‑level write and overwrite files belonging to another application. This flaw is a classic example of a timing-based race condition (CWE-367) and can lead to integrity compromise or privileged escalation on a local machine.

Electron framework applications on macOS that use Squirrel.Mac for automatic updates are affected, provided they are running a version prior to 39.8.10, 41.10.5, or 42.0.0‑beta.2. Windows or Linux Electron apps, and macOS apps that do not employ Squirrel.Mac, are not impacted. The issue has been fixed in the referenced Electron releases.

The CVSS score of 6.7 reflects moderate severity; the exploit requires local access and exploitation of the privileged ShipIt helper. The EPSS score is currently unavailable, but the lack of a public KEV listing suggests limited widespread exploitation. Nevertheless, a local attacker with sufficient privileges could leverage the race to tamper with other applications, making timely remediation essential.