Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M
CVE-2026-34768Electron: Unquoted executable path in app.setLoginItemSettings on Windows
Low 3.9
In plain English
A low-severity security flaw in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | electron | 38.8.6 | GHSA-jfqx-fxh3-c62j |
| npm | electron | 39.8.1 | GHSA-jfqx-fxh3-c62j |
| npm | electron | 40.8.0 | GHSA-jfqx-fxh3-c62j |
| npm | electron | 41.0.0-beta.8 | GHSA-jfqx-fxh3-c62j |
Affected products (as reported)
Weakness: CWE-428 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
References
- https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j x_refsource_CONFIRM