CVE-2026-34779: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Published Apr 3, 2026

Updated

Impact On macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected.

Workarounds There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions 41.0.0-beta.8 40.8.0 39.8.1 38.8.6

For more information If there are any questions or comments about this advisory, please email security@electronjs.org

Other sources

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

— MITRE

Affected Software

20 affected componentsFixes available

npm/electron>=41.0.0-alpha.1<41.0.0-beta.8

41.0.0-beta.8

npm/electron>=40.0.0-alpha.1<40.8.0

40.8.0

npm/electron>=39.0.0-alpha.1<39.8.1

39.8.1

npm/electron<38.8.6

38.8.6

electronjs Electron Node.js<38.8.6

electronjs Electron Node.js>=39.0.0<39.8.1

electronjs Electron Node.js>=40.0.0<40.8.0

electronjs Electron Node.js=41.0.0-alpha1

electronjs Electron Node.js=41.0.0-alpha2

electronjs Electron Node.js=41.0.0-alpha3

electronjs Electron Node.js=41.0.0-alpha4

electronjs Electron Node.js=41.0.0-alpha5

electronjs Electron Node.js=41.0.0-alpha6

electronjs Electron Node.js=41.0.0-beta1

electronjs Electron Node.js=41.0.0-beta2

electronjs Electron Node.js=41.0.0-beta3

electronjs Electron Node.js=41.0.0-beta4

electronjs Electron Node.js=41.0.0-beta5

electronjs Electron Node.js=41.0.0-beta6

electronjs Electron Node.js=41.0.0-beta7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 41.0.0-beta.8
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 40.8.0
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 39.8.1
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 39.8.1
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 40.8.0
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 41.0.0-beta.8

Event History

Apr 3, 2026

Advisory Published

via GitHub·02:46 AM

Data Sourced

via GitHub·02:46 AM

DescriptionSeverityWeaknessAffected Software

Apr 4, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

May 22, 58255

Event

via NVD·07:49 PM

CVE-2026-34779: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Other sources

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Company

Resources

Contact