Path Traversal Vulnerability in Electron Framework Affecting Multiple Versions
CVE-2026-70603

6MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70603?

The Electron framework, used for developing cross-platform desktop applications, has a vulnerability in the shell.openPath() function that allows attackers to bypass standard string validation of file paths. Specifically, prior to versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, the function did not correctly handle embedded null bytes in paths. This oversight enables malicious users to open unintended files if an application blindly trusts user input without performing comprehensive filesystem checks. The issue is resolved in the aforementioned updates, reinforcing the importance of thorough security practices in app development.

Affected Version(s)

electron < 39.8.6 < 39.8.6

electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0

electron >= 41.0.0-alpha.1, < 41.1.1 < 41.0.0-alpha.1, 41.1.1

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.