EUVD-2026-53436
GHSA-5c9j-mhmv-5xgx
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Local vector because exploitation requires influencing a running desktop app's input; AC:H reflects mandatory triple precondition (untrusted input + string-only validation + shell.openPath call); PR:L for attacker's ability to supply input; UI:R because user triggers the file-open action; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
AnalysisAI
Path validation bypass in Electron's shell.openPath() allows an attacker-controlled file to be opened in place of one that passed string-based extension validation, due to embedded null bytes not being rejected before OS-level path resolution. Electron-based desktop applications that accept untrusted file paths, validate them using only JavaScript string methods (e.g., endsWith(), regex extension checks), and then pass them to shell.openPath() are affected; apps using Node.js fs APIs (fs.existsSync(), fs.stat()) prior to the call are explicitly not vulnerable. Fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1; no public exploit identified at time of analysis.
Technical ContextAI
Electron (npm package, cpe:2.3:a:electron:electron:*) is a cross-platform desktop application framework combining Chromium and Node.js. Its shell.openPath() function delegates a file path string to the underlying OS shell for opening, but prior to the fix, it passed the string without null-byte sanitization. This creates a classic null-byte injection condition (CWE-20, Improper Input Validation): at the JavaScript layer, a path like '/valid/document.pdf\0/malicious.exe' appears to end in '.pdf', but POSIX/C runtime string functions treat '\0' as a string terminator, so the OS may resolve only '/valid/document.pdf' or exhibit platform-dependent truncation behavior. Node.js fs APIs already guard against this - they throw on null-byte paths - so apps that call any fs method on the path before shell.openPath() are protected by that existing guard. The vulnerability exists precisely in the gap between JavaScript-layer string validation and native OS path resolution.
RemediationAI
Upgrade Electron to a patched release: 39.8.6 (stable 39.x line), 40.9.0 (stable 40.x line), 41.1.1 (stable 41.x line), or 42.0.0-beta.1 (beta line), as documented at https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx. For applications that cannot immediately upgrade, the vendor-recommended workaround is to explicitly reject any path containing a null byte before passing it to shell.openPath(): enforce if (filePath.includes('\0')) throw new Error('invalid path'); at every call site. A structurally stronger mitigation - independent of the Electron version - is to perform a filesystem-level existence check using Node's fs.existsSync() or fs.stat() before calling shell.openPath(), as Node fs APIs already reject null-byte paths; this approach has the additional benefit of confirming the file exists and is accessible. Applications that do not pass untrusted input to shell.openPath() require no remediation action.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today