CVE-2026-70597
Received Received - Intake

Code Execution Bypass in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70597
EUVD
EUVD-2026-53403

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.8 (inc)
electron electron to 40.9.0 (inc)
electron electron to 41.2.1 (inc)
electron electron to 42.0.0-beta.3 (inc)
electron electron to 39.8.8 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building cross-platform desktop apps. A flaw in macOS checks allows a local attacker to bypass the verification that an Electron app was launched by a same-signed parent process. This could let the attacker run code inside a signed app, inheriting its permissions and access.

Detection Guidance

Detection requires checking Electron version against fixed releases (39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3). Use commands like 'electron --version' or inspect app bundle info to verify version.

Impact Analysis

If you use an affected Electron version on macOS, a local attacker could exploit this to execute malicious code within your signed Electron app. This could lead to unauthorized access to sensitive data, keychain items, or permissions granted to the app.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed due to the flaw.

Mitigation Strategies

Update Electron to fixed versions (39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3). Disable apps relying on vulnerable Electron versions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart