CVE-2026-70603: electron Improper Input Validation
Vulnerability summary
CVE-2026-70603 is a medium (CVSS 6.0) Improper Input Validation vulnerability in electron. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities.
Timeline
- 05-08-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- NVDNIST6.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.03 pp
From 0.10% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-158Improper Neutralization of Null Byte or NUL CharacterThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
Affected systems
Electron1 product
- electron< 39.8.6 | ≥ 40.0.0-alpha.1, < 40.9.0 | ≥ 41.0.0-alpha.1, < 41.1.1 | ≥ 42.0.0-alpha.1, < 42.0.0-beta.1
Electronjs1 product
- electron< 39.8.6 | ≥ 40.0.0, < 40.9.0 | ≥ 41.0.0, < 41.1.1 | 42.0.0:alpha1 | 42.0.0:alpha2 | 42.0.0:alpha3 | 42.0.0:alpha4 | 42.0.0:alpha5 | 42.0.0:alpha6 | 42.0.0:beta1
Npm1 product
- electron≥ 42.0.0-alpha.1, < 42.0.0-beta.1 | ≥ 41.0.0-alpha.1, < 41.1.1 | ≥ 40.0.0-alpha.1, < 40.9.0 | < 39.8.6
3 vendors · 3 products
References
2 links- github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgxX Refsource CONFIRMWEBVendor Advisory
- github.com/electron/electronPACKAGE