Electron applications that enable the nodeIntegrationInWorker option can unintentionally expose the Node.js runtime to web workers. Before the patched releases, the renderer process did not correctly scope this preference, allowing workers created in frames marked nodeIntegrationInWorker:false to still receive Node.js integration. This flaw enables an attacker to execute arbitrary JavaScript within the Node context, potentially leading to critical code‑execution or privilege escalation inside the desktop application. The weakness aligns with authorization bypass using privilege and improper restriction of operations categories.

This vulnerability affects Electron framework versions older than 38.8.6, 39.8.4, 40.8.4 and 41.0.0 when the nodeIntegrationInWorker option is enabled. Applications that never enable this setting are not impacted. Developers should verify whether their projects set webPreferences.nodeIntegrationInWorker:true and upgrade if necessary.

The advisory assigns a CVSS score of 6.8, indicating moderate severity. The EPSS score is below 1%, suggesting a low exploitation probability, and the flaw is not listed in the KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to supply a malicious worker script or otherwise inject code into an Electron app that has enabled nodeIntegrationInWorker. Because the vulnerability is local to the application runtime, it is most relevant to scenarios where an attacker has access to the host machine or compromised content within the app's renderer. Overall risk remains moderate with a low likelihood of exploitation.