Junglewise Threat Intelligence

CVE-2026-70611: Electron command injection in DevTools reveal in file manager

CVE-2026-70611 · Severity: medium · CVSS 6.9 · Published 2026-08-05

Executive brief

Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A vulnerability in its developer tools (DevTools) could allow a malicious extension or script to bypass security protections and execute unauthorized files on a user's computer. This could lead to the execution of malicious code outside of the application's restricted environment, potentially compromising the host system.

Technical details

A command injection vulnerability (CWE-78) exists in the Electron DevTools embedder handler. The 'reveal in file manager' action incorrectly handles file paths, allowing it to launch a target file rather than simply revealing its location in the OS file explorer. An attacker who can execute scripts within the DevTools frontend—for instance, via a malicious DevTools extension—can exploit this to achieve native code execution outside the renderer sandbox. The vulnerability is patched in versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3 by migrating the handler to use the more secure 'ShowItemInFolder' method.

Affected products

  • Electron Electron < 39.8.9, >= 40.0.0-alpha.1 < 40.9.2, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3

Timeline

  • 2026-04-11: patched: Initial backport PRs for fix merged
  • 2026-07-27: disclosed
  • 2026-08-05: advisory

References