Is CVE-2026-34768 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34768 being exploited in the wild.

How severe is CVE-2026-34768?

Low severity, with a CVSS score of 3.9, published 4 April 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=38.8.6.

Is there a fix for CVE-2026-34768?

Yes. electron (npm): upgrade to 38.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34768 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34768?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34768: Electron unquoted search path in app.setLoginItemSettings on Windows

CVE-2026-34768 · Severity: low · CVSS 3.9 · Published 2026-04-04

Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw on Windows allows a malicious actor to trick the system into running a different, unauthorized program when a user logs in. This risk primarily affects applications installed in non-standard folders where an attacker has permission to place files.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34768 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34768 being exploited in the wild.
How severe is CVE-2026-34768?: Low severity, with a CVSS score of 3.9, published 4 April 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=38.8.6.
Is there a fix for CVE-2026-34768?: Yes. electron (npm): upgrade to 38.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34768 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34768?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 38.8.6 or later
```
npm install electron@38.8.6
```

Technical details

An unquoted search path vulnerability (CWE-428) exists in Electron's 'app.setLoginItemSettings' API on Windows. When 'openAtLogin' is set to true, the framework writes the executable path to the Windows 'Run' registry key without surrounding quotes. If the installation path contains spaces, a local attacker with write access to an ancestor directory can place a malicious executable that Windows will prioritize over the intended application during the login sequence. Exploitation is difficult on standard Windows installations because system directories are typically write-protected, but it poses a risk for applications in custom or non-standard locations. The issue is fixed in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

Affected products

ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.1, >= 40.0.0-alpha.1 < 40.8.0, >= 41.0.0-alpha.1 < 41.0.0-beta.8

Identifiers

CVE-2026-34768
GHSA-jfqx-fxh3-c62j

Timeline

2026-04-02: advisory: GitHub Security Advisory published
2026-04-03: disclosed: NVD publication date
2026-04-03: patched: Patched versions released

References

https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.