Executive brief
Electron is a framework used to build desktop applications using web technologies. A vulnerability exists where applications using certain networking functions can be tricked by a malicious server into reading local files from the user's computer. If an application processes and displays the content of these redirected requests, an attacker could potentially steal sensitive local data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Electron's net.fetch() and net.request() APIs due to insufficient restriction of redirect schemes. When these functions follow an HTTP redirect, they do not prevent the request from targeting local resources (e.g., file://). An attacker can host a malicious server that redirects an application's request to a local file; if the application subsequently exposes the response body, the contents of that local file are disclosed. This affects applications that make requests to untrusted URLs with the default redirect behavior enabled. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected products
- Electron electron < 39.8.8, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory