Electron up to 38.8.5/39.8.0/40.7.x on Windows Setting unquoted search path

Summaryinfo

A vulnerability labeled as problematic has been found in Electron up to 38.8.5/39.8.0/40.7.x on Windows. This issue affects some unknown processing of the component Setting Handler. The manipulation results in unquoted search path. This vulnerability is known as CVE-2026-34768. Attacking locally is a requirement. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Electron up to 38.8.5/39.8.0/40.7.x on Windows. Affected is an unknown part of the component Setting Handler. The manipulation with an unknown input leads to a unquoted search path vulnerability. CWE is classifying the issue as CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-34768 since 03/30/2026. The exploitability is told to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.009.

Upgrading to version 38.8.6, 39.8.1, 40.8.0 or 41.0.0-beta.8 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Electron

Version

• 38.8.0
• 38.8.1
• 38.8.2
• 38.8.3
• 38.8.4
• 38.8.5
• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 39.8.0
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion