CVE-2026-70609: electron Code Injection
Vulnerability summary
CVE-2026-70609 is a medium (CVSS 5.7) Code Injection vulnerability in electron. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities.
Timeline
- 05-08-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
- NVDNIST5.7MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.13 pp
From 0.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Electron1 product
- electron< 39.8.7 | ≥ 40.0.0-alpha.1, < 40.9.0 | ≥ 41.0.0-alpha.1, < 41.2.0 | ≥ 42.0.0-alpha.1, < 42.0.0-beta.1
Electronjs1 product
- electronEOL< 39.8.7 | ≥ 40.0.0, < 40.9.0 | ≥ 41.0.0, < 41.2.0 | 42.0.0:alpha1 | 42.0.0:alpha2 | 42.0.0:alpha3 | 42.0.0:alpha4 | 42.0.0:alpha5 | 42.0.0:alpha6 | 42.0.0:beta1
Npm1 product
- electron< 39.8.7 | ≥ 40.0.0-alpha.1, < 40.9.0 | ≥ 41.0.0-alpha.1, < 41.2.0 | ≥ 42.0.0-alpha.1, < 42.0.0-beta.1
3 vendors · 3 products
References
14 links- github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8mX Refsource CONFIRMWEBVendor Advisory
- github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1X Refsource MISCWEBPatch
- github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33bX Refsource MISCWEBPatch
- github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ceX Refsource MISCWEBPatch
- github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7baX Refsource MISCWEBPatch
Show all 14 references
- github.com/electron/electronPACKAGE