Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2 Redirect net.fetch/net.request redirect

Summaryinfo

A vulnerability labeled as problematic has been found in Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2. This affects the function net.fetch/net.request of the component Redirect Handler. Executing a manipulation can lead to redirect. The identification of this vulnerability is CVE-2026-70605. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2 and classified as problematic. This vulnerability affects the function net.fetch/net.request of the component Redirect Handler. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-70605 since 08/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 39.8.8, 40.9.0, 41.2.1 or 42.0.0-beta.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 39.8.6
• 39.8.7
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 41.0
• 41.1
• 41.2.0
• 42.0.0-beta.0
• 42.0.0-beta.1
• 42.0.0-beta.2

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion