CVE-2026-34769: Electron argument injection via undocumented commandLineSwitches

CVE-2026-34769 · Severity: high · CVSS 7.7 · Published 2026-04-04

Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw in how some applications handle configuration settings could allow an attacker to bypass critical security protections, such as the 'sandbox' that keeps the application isolated from the rest of the computer. This could lead to unauthorized access to sensitive data or full control over the user's system if the application processes untrusted configuration data.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34769 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34769 being exploited in the wild.
How severe is CVE-2026-34769?
High severity, with a CVSS score of 7.7, published 4 April 2026.
Which products and versions are affected?
electron (npm) SEMVER:introduced=0,fixed=38.8.6.
Is there a fix for CVE-2026-34769?
Yes. electron (npm): upgrade to 38.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34769 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-34769?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 38.8.6 or later
    npm install electron@38.8.6

Technical details

A vulnerability exists in Electron due to an undocumented 'commandLineSwitches' property within the webPreferences object. When an application constructs this object by spreading untrusted or external configuration data without proper validation, an attacker can inject arbitrary switches into the renderer process command line. This can be used to disable the Chromium sandbox ('--no-sandbox') or other web security features. The attack requires the application to be designed in a way that it accepts and spreads untrusted input into the BrowserWindow or webContents configuration. The issue is addressed in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

Affected products

  • ElectronJS Electron < 38.8.6, 39.0.0-alpha.1 to < 39.8.0, 40.0.0-alpha.1 to < 40.7.0, 41.0.0-alpha.1 to < 41.0.0-beta.8

Identifiers

  • CVE-2026-34769
  • GHSA-9wfr-w7mm-pc7f

Timeline

  • 2026-04-02: advisory: GitHub Security Advisory published
  • 2026-04-03: disclosed: CVE published to NVD
  • 2026-04-04: patched: Patch availability confirmed in advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.