Electron up to 39.8.5/40.8.x/41.1.0/42.0.0-beta.0 Shell shell.openPath input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in Electron up to 39.8.5/40.8.x/41.1.0/42.0.0-beta.0. The affected element is the function shell.openPath of the component Shell. Such manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2026-70603. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Electron up to 39.8.5/40.8.x/41.1.0/42.0.0-beta.0. Affected by this issue is the function shell.openPath of the component Shell. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-70603 since 08/04/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 39.8.6, 40.9.0, 41.1.1 or 42.0.0-beta.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 41.0
• 41.1.0
• 42.0.0-beta

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion