What is the CVSS score of CVE-2026-70609?

CVE-2026-70609 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-70609?

Yes, a patch is available for CVE-2026-70609. Update the affected software to the latest version immediately.

Electron CVE-2026-70609

EUVD-2026-53566 MEDIUM

Code Injection (CWE-94)

2026-08-05 GitHub_M

GHSA-4f78-qhmw-8j8m

RCE Node.js Code Injection Electron

5.7

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker controls content loaded in Electron webview
Delivery

Webview content invokes openDevTools with injected mode string
Exploit

Unsanitized string reaches DevTools frontend JavaScript context
Execution

Injected payload executes in DevTools context
Persist

Node.js APIs accessed in unsandboxed Electron process
Impact

Arbitrary OS-level commands executed on host system

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Two concurrent conditions must both be satisfied: (1) the Electron application must be configured without the renderer sandbox, meaning the DevTools context retains Node.js API access (this is non-default in modern Electron but common in legacy apps using nodeIntegration or contextIsolation:false); AND (2) either untrusted external input must reach the `mode` argument of `webContents.openDevTools()` (e.g., a user-supplied string is passed without sanitization), or untrusted web content loaded inside a `<webview>` element must be able to invoke `openDevTools()` on that webview. Applications that exclusively pass one of the four hardcoded allowlisted values ('right', 'bottom', 'undocked', 'detach') as a string literal to `openDevTools()` are not vulnerable regardless of sandbox configuration. Applications that set `webPreferences.devTools: false` or never call `openDevTools()` in production are also not affected. Exploitation is bounded by these non-default configuration requirements - this is not a default-configuration or drive-by network vulnerability for typical Electron deployments.
Impact	The official CVSS 3.1 score is 5.7 (Medium) with vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. The PR:H and S:U choices appear to model the scenario where the developer's own application code is the only pathway for untrusted input to reach `openDevTools()`. However, the GHSA advisory explicitly identifies a second, lower-privilege vector: untrusted web content loaded in a `<webview>` element calling `openDevTools()` directly, which does not require high operator privileges (PR:N) and represents a scope change to the host OS via Node.js (S:C). The official vector therefore likely understates risk for webview-based attack paths. EPSS score was not provided in the input data. This CVE is not listed in CISA KEV, so confirmed active exploitation cannot be claimed. Under SSVC: exploitation status is 'none' (no public PoC confirmed), automatable is 'no' (specific non-default configuration required), technical impact is 'total' for unsandboxed apps. Real-world priority is high for applications that embed untrusted web content in webviews or route user input into `openDevTools()`, and effectively zero for applications using fixed, hardcoded dock modes in production builds.
Exploit ScenarioDerived	An attacker who controls web content loaded inside an Electron `<webview>` element crafts a malicious string and passes it as the `mode` argument when calling `openDevTools()` on the webview - an action the embedded content can trigger without elevated privileges in affected configurations. The unsanitized string reaches the Chromium DevTools frontend JavaScript context, where it is interpreted as executable code rather than a dock-state label. In an unsandboxed Electron app, the injected script runs with full Node.js access, enabling the attacker to read arbitrary files, exfiltrate credentials from the host filesystem, or spawn OS-level processes. No public exploit code has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 05, 2026

Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an unsanitized mode parameter supplied to webContents.openDevTools(). Unsandboxed Electron applications where untrusted input reaches the mode argument - or where untrusted content embedded in a <webview> element can invoke openDevTools() - are exposed to full Node.js-level code execution on the host operating system. No public exploit has been identified at time of analysis, but Electron's own GitHub Security Advisory (GHSA-4f78-qhmw-8j8m) confirms the flaw and vendor-released patches are available across all active release tracks.

RemediationAI

Upgrade Electron to a fixed version matching your active release track: 39.8.7 (https://github.com/electron/electron/releases/tag/v39.8.7), 40.9.0 (https://github.com/electron/electron/releases/tag/v40.9.0), 41.2.0 (https://github.com/electron/electron/releases/tag/v41.2.0), or 42.0.0-beta.1 (https://github.com/electron/electron/releases/tag/v42.0.0-beta.1). The patch in PRs #50665-50668 adds a compile-time kValidDockStates allowlist (bottom, left, right, undocked) to inspectable_web_contents.cc and defaults to 'right' on invalid input, eliminating the injection surface entirely. Where patching is not immediately possible, apply the documented workaround: only pass fixed allowlisted string literals ('right', 'bottom', 'undocked', 'detach') as the mode argument to openDevTools(), and never expose the openDevTools API to or allow it to be called by untrusted web content or webview-embedded pages. If DevTools are not required in production builds, setting webPreferences.devTools: false eliminates the attack surface without functional trade-offs for end users.

Affected VersionsENISA

electron 40.0.0-alpha.1, < 40.9.0

electron < 39.8.7

electron 41.0.0-alpha.1, < 41.2.0

electron 42.0.0-alpha.1, < 42.0.0-beta.1

Affected Packages

npm electron fix: 39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1

euvd electron_40_0_0_alpha_1 fix: 40.9.0

euvd electron_41_0_0_alpha_1 fix: 41.2.0

euvd electron_42_0_0_alpha_1 fix: 42.0.0-beta.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Electron is a cross-platform desktop application framework that co-embeds Chromium (for web rendering) and Node.js (for system access). The vulnerability originates in shell/browser/ui/inspectable_web_contents.cc, specifically InspectableWebContents::SetDockState() and the LoadCompleted() path. The mode option of webContents.openDevTools() controls how the DevTools panel docks (right, bottom, undocked, detach) and was passed directly, without an allowlist check, to the Chromium DevTools frontend JavaScript environment. Because this value is treated as data but reaches a JavaScript context that can interpret it as code, the root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The critical amplifier is that Electron's DevTools context, unlike a normal renderer, retains direct Node.js API access when the app runs unsandboxed - meaning code executing there can perform filesystem I/O, spawn child processes, and make network calls at the OS level. CPE: cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*.

Know when Electron gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.7 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

vuln.today AI 8.0 HIGH

Webview-embedded content requires no elevated privileges (PR:N), unsandboxed Node.js access from DevTools constitutes a scope change to the host (S:C), and AC:H reflects the non-default unsandboxed configuration prerequisite.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 19:18 EUVD

DescriptionCVE.org

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Medium

popular cross-platform desktop app framework, widely adopted but not infrastructure-ubiquitous

Threat Intel

1 sources

Data Quality

7 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment GHSA

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.