Is CVE-2026-70605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70605 being exploited in the wild.

How severe is CVE-2026-70605?

Medium severity, with a CVSS score of 5.9, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.8.

Is there a fix for CVE-2026-70605?

Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70605 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70605?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70605: Electron SSRF and local file disclosure via HTTP redirect

CVE-2026-70605 · Severity: medium · CVSS 5.9 · Published 2026-08-05

Electron is a framework used to build desktop applications using web technologies. A vulnerability exists where applications using certain networking functions can be tricked by a malicious server into reading local files from the user's computer. If an application processes and displays the content of these redirected requests, an attacker could potentially steal sensitive local data.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70605 being exploited in the wild.
How severe is CVE-2026-70605?: Medium severity, with a CVSS score of 5.9, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.8.
Is there a fix for CVE-2026-70605?: Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70605 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70605?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.8 or later
```
npm install electron@39.8.8
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Electron's net.fetch() and net.request() APIs due to insufficient restriction of redirect schemes. When these functions follow an HTTP redirect, they do not prevent the request from targeting local resources (e.g., file://). An attacker can host a malicious server that redirects an application's request to a local file; if the application subsequently exposes the response body, the contents of that local file are disclosed. This affects applications that make requests to untrusted URLs with the default redirect behavior enabled. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected products

Electron electron < 39.8.8, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3

Identifiers

CVE-2026-70605
GHSA-v64r-4m7r-3mvq

Timeline

2026-07-27: disclosed
2026-08-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.