What is the CVSS score of CVE-2026-70609?

CVE-2026-70609 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-70609?

Yes, a patch is available for CVE-2026-70609. Update the affected software to the latest version immediately.

Electron CVE-2026-70609

EUVD-2026-53566 MEDIUM

Code Injection (CWE-94)

2026-08-05 GitHub_M

GHSA-4f78-qhmw-8j8m

RCE Node.js Code Injection Electron

5.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.7 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.0 HIGH

Webview-embedded content requires no elevated privileges (PR:N), unsandboxed Node.js access from DevTools constitutes a scope change to the host (S:C), and AC:H reflects the non-default unsandboxed configuration prerequisite.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 18:23 vuln.today

Analysis Generated

Aug 05, 2026 - 18:23 vuln.today

DescriptionCVE.org

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

AnalysisAI

Code injection in Electron's DevTools API permits arbitrary script execution in the DevTools context via an unsanitized mode parameter supplied to webContents.openDevTools(). Unsandboxed Electron applications where untrusted input reaches the mode argument - or where untrusted content embedded in a <webview> element can invoke openDevTools() - are exposed to full Node.js-level code execution on the host operating system. No public exploit has been identified at time of analysis, but Electron's own GitHub Security Advisory (GHSA-4f78-qhmw-8j8m) confirms the flaw and vendor-released patches are available across all active release tracks.

Technical ContextAI

Electron is a cross-platform desktop application framework that co-embeds Chromium (for web rendering) and Node.js (for system access). The vulnerability originates in shell/browser/ui/inspectable_web_contents.cc, specifically InspectableWebContents::SetDockState() and the LoadCompleted() path. The mode option of webContents.openDevTools() controls how the DevTools panel docks (right, bottom, undocked, detach) and was passed directly, without an allowlist check, to the Chromium DevTools frontend JavaScript environment. Because this value is treated as data but reaches a JavaScript context that can interpret it as code, the root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The critical amplifier is that Electron's DevTools context, unlike a normal renderer, retains direct Node.js API access when the app runs unsandboxed - meaning code executing there can perform filesystem I/O, spawn child processes, and make network calls at the OS level. CPE: cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Electron to a fixed version matching your active release track: 39.8.7 (https://github.com/electron/electron/releases/tag/v39.8.7), 40.9.0 (https://github.com/electron/electron/releases/tag/v40.9.0), 41.2.0 (https://github.com/electron/electron/releases/tag/v41.2.0), or 42.0.0-beta.1 (https://github.com/electron/electron/releases/tag/v42.0.0-beta.1). The patch in PRs #50665-50668 adds a compile-time kValidDockStates allowlist (bottom, left, right, undocked) to inspectable_web_contents.cc and defaults to 'right' on invalid input, eliminating the injection surface entirely. Where patching is not immediately possible, apply the documented workaround: only pass fixed allowlisted string literals ('right', 'bottom', 'undocked', 'detach') as the mode argument to openDevTools(), and never expose the openDevTools API to or allow it to be called by untrusted web content or webview-embedded pages. If DevTools are not required in production builds, setting webPreferences.devTools: false eliminates the attack surface without functional trade-offs for end users.