Vulnerability in Electron Framework Affects Desktop Applications
CVE-2026-70611
6.9MEDIUM
What is CVE-2026-70611?
A vulnerability in the Electron framework allows an attacker to exploit the DevTools feature, potentially executing native code outside of the application sandbox. If an attacker can run scripts within the DevTools frontend, such as through a malicious extension, they could leverage the 'showItemInFolder' functionality to launch files rather than simply revealing them. This poses a security risk for applications that are exposed to untrusted content or extensions. The issue has been addressed in versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Affected Version(s)
electron < 39.8.9 < 39.8.9
electron >= 40.0.0-alpha.1, < 40.9.2 < 40.0.0-alpha.1, 40.9.2
electron >= 41.0.0-alpha.1, < 41.2.1 < 41.0.0-alpha.1, 41.2.1