# CVE-2023-39956: Electron out-of-package code execution with arbitrary working directory

Source: https://junglewise.ai/threats/cve-2023-39956-electron-out-of-package-code-execution-with-arbitrary-working  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-39956 · Severity: low · CVSS 3.1 · Published 2023-09-06

Electron, a framework used to build cross-platform desktop applications, is vulnerable to arbitrary code execution when launched with an attacker-controlled working directory. This affects command-line executables that expose entry points (e.g., `myapp --help`). An attacker with the ability to write files to the app's working directory can execute malicious code, potentially compromising the application and any data it processes. The vulnerability requires both local access and the ability to write to the target directory, limiting exposure but bypassing security features like ASAR integrity checks.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-39956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-39956 being exploited in the wild.

**How severe is CVE-2023-39956?** Low severity, with a CVSS score of 3.1, published 6 September 2023.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=22.3.19.

**Is there a fix for CVE-2023-39956?** Yes. electron (npm): upgrade to 22.3.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-39956 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2023-39956?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 22.3.19 or later

  ```sh
  npm install electron@22.3.19
  ```


## Technical details

The vulnerability is a code execution flaw (CWE-94) triggered when Electron applications launched as command-line executables operate in an attacker-controlled working directory. The root cause involves insufficient validation of the current working directory during module or resource loading, allowing an attacker to place malicious files that are subsequently loaded and executed by the application. Exploitation requires local access (AV:L), low privilege (PR:L), and user interaction (UI:R), with no scope change. The attack can result in code execution with high integrity impact (I:H) and some confidentiality and availability loss (C:L, A:L). Patches are available in versions 22.3.19, 23.3.13, 24.7.1, 25.5.0, and 26.0.0-beta.13 or later; applications must update to a patched version as there are no workarounds.

## Affected products

- OpenJS Foundation Electron < 22.3.19, 23.0.0-alpha.1 to < 23.3.13, 24.0.0-alpha.1 to < 24.7.1, 25.0.0-alpha.1 to < 25.5.0, 26.0.0-alpha.1 to < 26.0.0-beta.13

## Identifiers

- CVE-2023-39956
- GHSA-7x97-j373-85x5

## Timeline

- 2023-09-06: disclosed

## References

- [https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5](https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)