EUVD-2026-53545
GHSA-f2r8-jv7c-xqmp
Severity by source
AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Exploitation requires attacker-controlled script already running in the privileged DevTools context (PR:H, AC:H) and explicit user action to open DevTools (UI:R); sandbox escape drives S:C with full C and I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
AnalysisAI
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3 via the DevTools 'reveal in file manager' handler, which incorrectly forwarded attacker-supplied paths to the OS shell-open primitive rather than a safe folder-reveal call. Exploitation requires an attacker to already control JavaScript execution within the DevTools frontend - most plausibly through a malicious DevTools extension - while DevTools is open against a window loading untrusted content. No public exploit code exists and the vulnerability is not listed in CISA KEV; patched releases are available across all active Electron stable and beta branches.
Technical ContextAI
Electron is an npm package (CPE: cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*) that wraps Chromium and Node.js to power cross-platform desktop applications. The vulnerable component is InspectableWebContents::ShowItemInFolder in shell/browser/ui/inspectable_web_contents.cc. The DevTools frontend communicates with the Electron main process via DevToolsAPI.sendMessageToEmbedder(); the 'showItemInFolder' message handler received a filesystem path from the DevTools renderer and passed it to platform_util::OpenPath() - a native OS shell-open call that can launch and execute files - rather than the semantically correct platform_util::ShowItemInFolder(). Because the DevTools renderer is web-hosted and can be attacker-influenced, this constitutes CWE-78 (Improper Neutralization of Special Elements used in an OS Command) at the process boundary between the sandboxed renderer and the privileged main process. The fix, visible in PR #50937, gates the call behind a check against kDevToolsFileSystemPaths, the set of workspace folders the user has explicitly registered; paths not under a registered workspace root are silently discarded rather than forwarded to the OS.
RemediationAI
Upgrade to Electron 39.8.9, 40.9.2, 41.2.1, or 42.0.0-beta.3; the patched release tags are available at https://github.com/electron/electron/releases/tag/v39.8.9, /v40.9.2, /v41.2.1, and /v42.0.0-beta.3 respectively. The upstream fixes are confirmed merged via PR #50937 and PR #50938. If immediate upgrade is not feasible, the vendor-documented workaround is to never open DevTools for BrowserWindows that load untrusted content and to avoid loading untrusted DevTools extensions; this eliminates the exploitation surface entirely but may disrupt developer workflows that inspect untrusted content in-app. No other compensating controls are identified in the advisory.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today