CVE-2026-70611

medium

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

Vendor / product: Electronjs — electron

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

CVSS

6.9

6.9 (CVSS v3.1)

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-08-05 18:17

Modified: 2026-11-03 23:17

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-11-03 23:24 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

electronjs / electron <39.8.9, ≥40.0.0 <40.9.2, ≥41.0.0 <41.2.1, 42.0.0

Weakness classification (CWE)

CWE-78

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp

Patch / mitigation: https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322

Patch / mitigation: https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771

Patch / mitigation: https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44

Patch / mitigation: https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de

Patch / mitigation: https://github.com/electron/electron/pull/50937

Patch / mitigation: https://github.com/electron/electron/pull/50938

Patch / mitigation: https://github.com/electron/electron/pull/51114

Patch / mitigation: https://github.com/electron/electron/pull/51115

References

https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322 security-advisories@github.com
https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771 security-advisories@github.com
https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44 security-advisories@github.com
https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de security-advisories@github.com
https://github.com/electron/electron/pull/50937 security-advisories@github.com
https://github.com/electron/electron/pull/50938 security-advisories@github.com
https://github.com/electron/electron/pull/51114 security-advisories@github.com
https://github.com/electron/electron/pull/51115 security-advisories@github.com
https://github.com/electron/electron/releases/tag/v39.8.9 security-advisories@github.com
https://github.com/electron/electron/releases/tag/v40.9.2 security-advisories@github.com
https://github.com/electron/electron/releases/tag/v41.2.1 security-advisories@github.com
https://github.com/electron/electron/releases/tag/v42.0.0-beta.3 security-advisories@github.com
https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 23:24 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-70611

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs