Microsoft
CVE-2026-34768
LOW
GHSA-jfqx-fxh3-c62j
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
On Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app.
On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location.
Workarounds
Install the application to a path without spaces, or to a location where all ancestor directories are protected against unauthorized writes.
Fixed Versions
41.0.0-beta.840.8.039.8.138.8.6
For more information
If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
AnalysisAI
Electron's setLoginItemSettings() function on Windows fails to quote executable paths in the Run registry key, allowing local attackers with write access to ancestor directories to execute arbitrary programs at login if the app is installed to a path containing spaces. The vulnerability affects Electron versions prior to 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, and requires high-privilege access and unfavorable conditions (non-standard install paths) to exploit, making real-world impact limited to non-default Windows configurations.
Technical ContextAI
Electron is a framework for building cross-platform desktop applications using web technologies. The setLoginItemSettings() API on Windows writes application paths to the Windows Registry's Run key to enable auto-launch at user login. The vulnerability stems from improper path handling: when an executable path contains spaces and is not quoted in the registry, the Windows registry parser interprets the path up to the first space as the executable to launch, with the remainder treated as arguments. If a directory in the path hierarchy (e.g., 'C:\Program Files (x86)\Company Name\App Name\app.exe') is writable by a non-administrative user, an attacker can place a malicious executable in an ancestor directory (e.g., 'C:\Program Files (x86)\Company Name\malicious.exe') to be executed instead. CWE-428 (Unquoted Search Path or Element) identifies the root cause: failure to properly quote or escape path elements that contain special characters like spaces.
RemediationAI
Update Electron to version 38.8.6 or later (for the 38.x series), 39.8.1 or later (39.x series), 40.8.0 or later (40.x series), or 41.0.0-beta.8 or later (41.x series). Application developers should regenerate and redeploy their Electron-based applications with the patched framework. As an interim workaround pending updates, end-users and system administrators should install affected applications to Windows paths without spaces (e.g., 'C:\Apps\MyApp' rather than 'C:\Program Files\My App'), or ensure all ancestor directories in the installation path are protected against unauthorized writes. Refer to the GitHub Security Advisory at https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j for additional context and to verify patch availability for your specific Electron version.
Same weakness CWE-428 – Unquoted Search Path or Element
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today