Arbitrary AppleScript Execution Vulnerability in Electron Framework
CVE-2026-34779

6.5MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
4 April 2026

What is CVE-2026-34779?

The Electron framework, widely used for developing cross-platform desktop applications, experienced a vulnerability in the app.moveToApplicationsFolder() method prior to certain patched versions. This vulnerability occurred on macOS due to an inadequately managed fallback path using AppleScript, which could allow for arbitrary code execution under specific circumstances. Developers utilizing this API in their applications should upgrade to the secure versions 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8 to mitigate potential risks.

Affected Version(s)

electron < 38.8.6 < 38.8.6

electron >= 39.0.0-alpha.1, < 39.8.1 < 39.0.0-alpha.1, 39.8.1

electron >= 40.0.0-alpha.1, < 40.8.0 < 40.0.0-alpha.1, 40.8.0

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.