Remote Resource Disclosure in Electron Framework
CVE-2026-70605
5.9MEDIUM
What is CVE-2026-70605?
The Electron framework, used for developing cross-platform desktop applications, has a vulnerability where net.fetch() and net.request() fail to restrict redirect schemes. This allows a remote server to redirect requests to local resources, potentially leading to unauthorized disclosure of local file contents if the application inadvertently forwards or returns the response body. This issue impacts implementations that make network requests to URLs controlled by an attacker and follow their redirects. Updated versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 address this vulnerability.
Affected Version(s)
electron < 39.8.8 < 39.8.8
electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0
electron >= 41.0.0-alpha.1, < 41.2.1 < 41.0.0-alpha.1, 41.2.1