Executive brief
Electron, a framework used to build desktop applications, contains a vulnerability in how it handles file paths. An attacker could potentially trick an application into opening a different file than intended by using specially crafted file paths. This could lead to unauthorized access to sensitive files or the execution of unintended programs if the application relies on simple text-based checks to validate file access.
Technical details
A path validation bypass exists in Electron's shell.openPath() API due to improper neutralization of null bytes (CWE-158). When an application performs string-based validation (such as checking file extensions) on a path containing an embedded null byte ('\0') before passing it to shell.openPath(), the validation may succeed on the full string while the underlying operating system API truncates the path at the null byte. This allows an attacker to bypass security checks and force the application to open a different file than the one validated. The vulnerability is exploitable if the application handles untrusted input and does not perform a filesystem-level check (like fs.stat()) before calling the affected API. Fixed versions include 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
Affected products
- Electron Electron < 39.8.6, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.1.1, >= 42.0.0-alpha.1 < 42.0.0-beta.1
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory
References
- https://api.github.com/users/yassine-doyensec
- https://github.com/yassine-doyensec
- https://api.github.com/users/yassine-doyensec/gists%7B/gist_id%7D
- https://api.github.com/users/yassine-doyensec/repos
- https://avatars.githubusercontent.com/u/241799566?v=4
- https://api.github.com/users/yassine-doyensec/events%7B/privacy%7D