Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M

CVE-2026-70609Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Medium 5.7

In plain English

A medium-severity code injection in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmelectron39.8.7GHSA-4f78-qhmw-8j8m
npmelectron40.9.0GHSA-4f78-qhmw-8j8m
npmelectron41.2.0GHSA-4f78-qhmw-8j8m
npmelectron42.0.0-beta.1GHSA-4f78-qhmw-8j8m

Affected products (as reported)

VendorProductVersions
electron electron < 39.8.7>= 40.0.0-alpha.1, < 40.9.0>= 41.0.0-alpha.1, < 41.2.0>= 42.0.0-alpha.1, < 42.0.0-beta.1

Weakness: CWE-94, CWE-116 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

References