Executive brief
Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw on Windows allows a malicious actor to trick the system into running a different, unauthorized program when a user logs in. This risk primarily affects applications installed in non-standard folders where an attacker has permission to place files.
Technical details
An unquoted search path vulnerability (CWE-428) exists in Electron's 'app.setLoginItemSettings' API on Windows. When 'openAtLogin' is set to true, the framework writes the executable path to the Windows 'Run' registry key without surrounding quotes. If the installation path contains spaces, a local attacker with write access to an ancestor directory can place a malicious executable that Windows will prioritize over the intended application during the login sequence. Exploitation is difficult on standard Windows installations because system directories are typically write-protected, but it poses a risk for applications in custom or non-standard locations. The issue is fixed in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
Affected products
- ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.1, >= 40.0.0-alpha.1 < 40.8.0, >= 41.0.0-alpha.1 < 41.0.0-beta.8
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: NVD publication date
- 2026-04-03: patched: Patched versions released