CVE-2026-70611

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

• CWE-78

• https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322
• https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771
• https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44
• https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de
• https://github.com/electron/electron/pull/50937
• https://github.com/electron/electron/pull/50938
• https://github.com/electron/electron/pull/51114
• https://github.com/electron/electron/pull/51115
• https://github.com/electron/electron/releases/tag/v39.8.9
• https://github.com/electron/electron/releases/tag/v40.9.2
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3
• https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp

Published

Aug 5, 2026

Last Modified

Aug 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70606Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-70607Electron is a framework for writing cross-platform desktop a…5.3
• CVE-2026-70608Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2026-70609Electron is a framework for writing cross-platform desktop a…5.7
• CVE-2026-7061A weakness has been identified in Toowiredd chatgpt-mcp-serv…7.3
• CVE-2026-70610Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-70612Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-70615boringproxy through 0.10.0 contains a newline injection vuln…9.9
• CVE-2026-70616boringproxy through 0.10.0 contains a resource exhaustion vu…7.1
• CVE-2026-70617Spacebar Server before commit dcfd910 contains a missing aut…8.6
• CVE-2026-70618Spacebar Server before commit 51da17c contains a missing aut…5.3
• CVE-2026-70619Odysseus before commit bf325f6 contains a missing authorizat…8.8