Electron up to 39.8.8/40.9.1/41.2.0/42.0.0-beta.2 DevTools showItemInFolder sandbox

Summaryinfo

A vulnerability was found in Electron up to 39.8.8/40.9.1/41.2.0/42.0.0-beta.2. It has been classified as critical. The impacted element is the function showItemInFolder of the component DevTools. Performing a manipulation results in sandbox. This vulnerability is cataloged as CVE-2026-70611. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Electron up to 39.8.8/40.9.1/41.2.0/42.0.0-beta.2. It has been classified as critical. This affects the function showItemInFolder of the component DevTools. The manipulation with an unknown input leads to a sandbox vulnerability. CWE is classifying the issue as CWE-265. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-70611 since 08/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1611 for this issue.

Upgrading to version 39.8.9, 40.9.2, 41.2.1 or 42.0.0-beta.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 39.8.6
• 39.8.7
• 39.8.8
• 40.9.0
• 40.9.1
• 41.0
• 41.1
• 41.2.0
• 42.0.0-beta.0
• 42.0.0-beta.1
• 42.0.0-beta.2

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion