Is CVE-2026-70603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70603 being exploited in the wild.

How severe is CVE-2026-70603?

Medium severity, with a CVSS score of 6, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.0-beta.1.

Is there a fix for CVE-2026-70603?

Yes. electron (npm): upgrade to 42.0.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70603 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-70603?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70603: Electron shell.openPath path validation bypass via embedded null byte

CVE-2026-70603 · Severity: medium · CVSS 6 · Published 2026-08-05

Electron's shell.openPath() function failed to reject file paths containing embedded null bytes, allowing attackers to bypass file extension validation checks. Applications that validate only the filename string (e.g., checking for a .pdf extension) before opening files could be tricked into opening arbitrary files. This affects desktop applications built with Electron that accept untrusted file paths and rely solely on string-based validation.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70603 being exploited in the wild.
How severe is CVE-2026-70603?: Medium severity, with a CVSS score of 6, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.0-beta.1.
Is there a fix for CVE-2026-70603?: Yes. electron (npm): upgrade to 42.0.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70603 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-70603?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 42.0.0-beta.1 or later
```
npm install electron@42.0.0-beta.1
```

Technical details

The vulnerability exists in Electron's shell.openPath() API, which did not validate or reject paths containing embedded null bytes (0x00 characters). This violates CWE-158 (Improper Neutralization of Null Byte) and CWE-20 (Improper Input Validation). An attacker can craft a malicious file path like "/trusted/file.pdf\0/malicious/file.exe" that passes string-based validation (checking for ".pdf" extension) but opens a different file when passed to shell.openPath(). The vulnerability requires an application to (1) accept paths from untrusted input, (2) validate only the string representation without filesystem checks, and (3) pass the path to shell.openPath(). Applications using Node.js fs APIs (fs.existsSync, fs.stat) are unaffected as those already reject null bytes. Patches are available in versions 42.0.0-beta.1, 41.1.1, 40.9.0, and 39.8.6.

Affected products

Electron Electron < 39.8.6, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.1.1, >= 42.0.0-alpha.1 < 42.0.0-beta.1

Identifiers

CVE-2026-70603
GHSA-5c9j-mhmv-5xgx

Timeline

2026-08-05: disclosed: Vulnerability published as GHSA-5c9j-mhmv-5xgx
2026-08: patched: Fixed in versions 39.8.6, 40.9.0, 41.1.1, 42.0.0-beta.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.