Executive brief
Electron's app.moveToApplicationsFolder() function on macOS contains an AppleScript injection vulnerability when handling application paths with special characters. An attacker with local access could craft a malicious application bundle path that executes arbitrary AppleScript commands when a user accepts the move-to-Applications prompt, potentially compromising the system or accessing sensitive data. Only applications that explicitly call this API are affected.
Technical details
The vulnerability is an OS command injection flaw (CWE-78) in Electron's macOS-specific moveToApplicationsFolder() API. The function uses an AppleScript fallback path that fails to properly sanitize special characters present in the application bundle path. An attacker can construct a crafted launch path containing shell metacharacters that break out of the intended AppleScript context, leading to arbitrary AppleScript execution when a user confirms the move-to-Applications dialog. This requires local access and user interaction (accepting the prompt), but no elevated privileges. The attack can result in high confidentiality and integrity impact. Patches are available in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8 or later.
Affected products
- Electron Electron < 38.8.6, >= 39.0.0-alpha.1 and < 39.8.1, >= 40.0.0-alpha.1 and < 40.8.0, >= 41.0.0-alpha.1 and < 41.0.0-beta.8
Timeline
- 2026-04-03: disclosed: Vulnerability published in GHSA-5rqw-r77c-jp79
- 2026-04-03: patched: Patches released: 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8