CVE-2026-70611
Received Received - Intake

Electron DevTools File Execution Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70611
EUVD
EUVD-2026-53545

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.9 (inc)
electron electron to 40.9.2 (inc)
electron electron to 41.2.1 (inc)
electron electron to 42.0.0-beta.3 (inc)
electron electron to 39.8.9 (exc)
electron electron to 40.9.2 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building desktop apps with JavaScript, HTML, and CSS. Due to improper handling in DevTools, an attacker could trick the system into executing native code outside the sandbox by using a malicious DevTools extension or script. This occurs when DevTools is opened for windows exposed to untrusted content.

Detection Guidance

Detecting this vulnerability requires checking if your Electron application is running an affected version. Use commands like 'electron --version' to check the version. If it's below 39.8.9, 40.9.2, 41.2.1, or 42.0.0-beta.3, the system is vulnerable. Additionally, monitor for unusual file execution attempts via DevTools when untrusted content is present.

Impact Analysis

An attacker could gain control over your system by executing arbitrary code if they can run malicious scripts in DevTools. This could lead to data theft, system compromise, or further attacks. Users running outdated Electron versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected Electron versions may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update Electron to version 39.8.9, 40.9.2, 41.2.1, or 42.0.0-beta.3 or later to address the vulnerability in DevTools file manager actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart