Electron EUVD-2026-53442

Exploitation requires all three of the following conditions simultaneously: (1) the Electron application makes net.fetch() or net.request() calls to URLs that are influenced or controlled by an attacker - applications that exclusively request fixed, hardcoded, trusted URLs are explicitly not affected per the advisory; (2) redirect following is enabled, which is the default behavior of the net module and therefore present unless explicitly overridden by the developer; and (3) the application exposes, forwards, or returns the HTTP response body in a way observable by the attacker. Exploitation is constrained by all three conditions: if the app does not expose response bodies, requests only trusted endpoints, or has redirect set to 'error' or 'manual', it is not vulnerable. The attacker requires no authentication to the Electron application itself (the redirect is delivered by an attacker-controlled server), but the app must be making outbound requests into the attacker's sphere of influence.

The NVD CVSS 3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N is well-calibrated. AC:H is appropriate because exploitation requires three simultaneous conditions (attacker-influenced URLs, redirect following enabled, response body exposure), which substantially narrows the vulnerable population. The High confidentiality impact is justified by potential disclosure of arbitrary local files. No CISA KEV listing is present in the provided data, no EPSS score was supplied, and no public proof-of-concept code is identified - collectively these signals indicate this is not an actively exploited opportunistic threat at this time. The practical risk is highest for Electron applications that act as proxies or relay net response bodies downstream, and lowest for applications making only hardcoded, trusted-URL requests. There is no integrity or availability impact, consistent with a read-only SSRF primitive. A minor version discrepancy exists in the source data: the CVE description cites 40.9.0 as fixed for the 40.x branch, while the npm package advisory lists the fixed version as 40.9.1 - both should be treated as the minimum safe version for that branch until confirmed by the vendor.

An attacker who controls or has compromised a web server targeted by an Electron application configures that server to respond to a legitimate-looking API request with an HTTP 302 redirect pointing to file:///etc/passwd or a Windows credential file path. The Electron app, following redirects by default, fetches the local resource and returns the contents in its response body to the attacker's infrastructure or a downstream consumer the attacker can observe, disclosing sensitive local file contents without any user interaction or special privileges.