CVE-2026-70611: electron OS Command Injection
Vulnerability summary
CVE-2026-70611 is a medium (CVSS 6.9) OS Command Injection vulnerability in electron. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.
Timeline
- 05-08-2026PublishedVulnerability first disclosed.
- 06-08-2026Last modifiedVulnerability information updated.
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
- NVDNIST6.9MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
+0.01 pp
From 0.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Electron1 product
- electron< 39.8.9 | ≥ 40.0.0-alpha.1, < 40.9.2 | ≥ 41.0.0-alpha.1, < 41.2.1 | ≥ 42.0.0-alpha.1, < 42.0.0-beta.3
Electronjs1 product
- electronEOL< 39.8.9 | ≥ 40.0.0, < 40.9.2 | ≥ 41.0.0, < 41.2.1 | 42.0.0:alpha1 | 42.0.0:alpha2 | 42.0.0:alpha3 | 42.0.0:alpha4 | 42.0.0:alpha5 | 42.0.0:alpha6 | 42.0.0:beta1 | 42.0.0:beta2
Npm1 product
- electron< 39.8.9 | ≥ 40.0.0-alpha.1, < 40.9.2 | ≥ 41.0.0-alpha.1, < 41.2.1 | ≥ 42.0.0-alpha.1, < 42.0.0-beta.3
3 vendors · 3 products
References
14 links- github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmpX Refsource CONFIRMWEBVendor Advisory
- github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322X Refsource MISCWEBPatch
- github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44X Refsource MISCWEBPatch
- github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43deX Refsource MISCWEBPatch
Show all 14 references
- github.com/electron/electronPACKAGE