CVE-2026-34767: electron Injection

Vulnerability summary

CVE-2026-34767 is a medium (CVSS 6.5) Injection vulnerability in electron. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.

Timeline

1. 03-04-2026
   PublishedVulnerability first disclosed.
2. 06-04-2026
   Last modifiedVulnerability information updated.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.