Arbitrary Command Line Switch Injection in Electron Framework
CVE-2026-34769

7.8HIGH

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
3 April 2026

What is CVE-2026-34769?

The Electron framework has a vulnerability that allows arbitrary command line switches to be appended to the renderer process. This occurs through an undocumented commandLineSwitches webPreference. Applications that dynamically construct webPreferences using untrusted configuration objects may inadvertently enable an attacker to inject malicious switches that could disable renderer sandboxing or security controls. Only apps that accept external or untrusted input without proper validation are at risk. The issue has been resolved with patches in specific versions.

Affected Version(s)

electron < 38.8.6 < 38.8.6

electron >= 39.0.0-alpha.1, < 39.8.0 < 39.0.0-alpha.1, 39.8.0

electron >= 40.0.0-alpha.1, < 40.7.0 < 40.0.0-alpha.1, 40.7.0

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.