CVE-2026-70605 in Electron
Summary
by MITRE • 08/05/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability affects the Electron framework's handling of HTTP redirects in net.fetch() and net.request() methods, creating a potential information disclosure risk through improper scheme validation. The flaw exists in versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 where the framework fails to restrict redirect targets based on URL schemes. When an application follows HTTP redirects without proper scheme validation, a malicious server can manipulate the redirect chain to point to local resources such as file:// URLs or other privileged schemes. This represents a classic case of insufficient input validation and access control enforcement that aligns with CWE-20, which covers "Improper Input Validation" in security contexts.
The technical implementation of this vulnerability stems from Electron's network request handling logic where the redirect mechanism does not properly verify that redirected URLs maintain appropriate scheme boundaries. When an application makes a net request to a URL controlled by an attacker and subsequently follows redirects, the framework processes these redirects without ensuring they remain within acceptable protocol boundaries. This allows attackers to construct redirect chains that ultimately resolve to local file system resources, potentially exposing sensitive data from the victim's machine. The vulnerability specifically impacts applications that process response bodies from such requests, particularly those that return or forward the content to end users.
The operational impact of this vulnerability is significant for Electron-based desktop applications that handle user-controlled input through network requests. Attackers can exploit this weakness by crafting malicious HTTP responses that redirect to local files, potentially disclosing sensitive information such as system configuration files, user data, application logs, or other privileged resources accessible through the application's execution context. This creates a vector for local file inclusion attacks and information disclosure scenarios that could lead to privilege escalation or data exfiltration depending on the application's access controls and the sensitivity of locally accessible resources. The attack requires the victim application to be configured to follow redirects automatically while processing attacker-influenced URLs, making it a targeted vulnerability requiring specific conditions.
Mitigation strategies for this vulnerability include upgrading to the patched versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 where proper scheme validation has been implemented. Organizations should also implement additional defensive measures such as configuring applications to disable automatic redirect following when dealing with untrusted URLs, implementing explicit scheme validation checks in custom network handling code, and employing application firewalls that can monitor and restrict potentially dangerous redirect patterns. Security teams should conduct thorough code reviews focusing on network request handling logic, particularly examining instances where net.fetch() or net.request() methods are used with user-controllable input. This vulnerability demonstrates the importance of following ATT&CK framework techniques related to command and control communications and credential access, as it enables attackers to access local resources through manipulated network requests. The fix implements proper scheme restriction mechanisms that align with security best practices for preventing protocol confusion attacks and unauthorized resource access in cross-platform applications.