EUVD-2026-53442
GHSA-v64r-4m7r-3mvq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the three-condition prerequisite; PR:N because no attacker-side privileges are needed; C:H for local file disclosure; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
AnalysisAI
Unrestricted HTTP redirect scheme following in Electron's net module (versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3) enables server-side request forgery leading to local file disclosure. When net.fetch() or net.request() follows a redirect issued by an attacker-controlled server targeting a local scheme such as file://, the Electron app can be made to read and expose local filesystem contents if it forwards or returns the response body. No public exploit is identified at time of analysis; however, the vulnerability class (SSRF via redirect scheme bypass, CWE-918) is well understood, and the default redirect-following behavior increases the practical surface area across affected apps.
Technical ContextAI
Electron is a cross-platform desktop application framework built on Chromium and Node.js, distributed via npm (CPE: cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*). Its net module exposes net.fetch() and net.request() as higher-level networking APIs. The root cause (CWE-918: Server-Side Request Forgery) is the absence of scheme allowlisting in the HTTP redirect chain processor: when a server responds with a 3xx redirect, Electron's net module faithfully follows it regardless of the target scheme, permitting transitions from http/https to file:// or other local-resource schemes. Since redirect following is the default mode, any Electron application making outbound requests to attacker-influenced endpoints is structurally exposed without developer action to opt out. The fix, published in the GitHub advisory GHSA-v64r-4m7r-3mvq, addresses this by enforcing scheme restrictions on redirect targets.
RemediationAI
Upgrade Electron to a patched release: 39.8.8 for the 39.x branch, 40.9.1 for the 40.x branch (note the minor discrepancy between the CVE description citing 40.9.0 and the npm advisory citing 40.9.1 - use 40.9.1 to be safe), 41.2.1 for the 41.x branch, or 42.0.0-beta.3 for the 42.x pre-release branch. Full patch details are at https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq. If an immediate upgrade is not possible, the Electron advisory explicitly recommends setting redirect: 'error' or redirect: 'manual' on all net.fetch() and net.request() calls that target untrusted or attacker-influenced URLs, and manually validating any redirect target URL before following it. The trade-off of this workaround is that it requires application-level code changes across all relevant call sites, may break features that rely on transparent redirect following, and is only as robust as the validation logic applied - incomplete URL validation could leave residual risk. Applications that exclusively request hardcoded, trusted URLs are not affected and require no remediation.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today