CVE-2026-70603: Electron: shell.openPath path validation bypass via embedded null byte
Impact shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths (for example, checking the file extension) before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation.
Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. Node's fs APIs already reject paths containing null bytes, so apps that call fs.existsSync(), fs.stat(), or similar before shell.openPath() are not affected. Apps that do not call shell.openPath() with untrusted input are not affected.
Workarounds Reject any path containing a null byte before passing it to shell.openPath(): js if (filePath.includes('\0')) throw new Error('invalid path');
Fixed Versions 42.0.0-beta.1 41.1.1 40.9.0 39.8.6
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.6 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.1.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0-beta.1 - Configuration
Before passing any path derived from untrusted input to Electron's shell.openPath(), validate the path and reject it if it contains an embedded null byte (for example, if filePath includes '\0', throw an error / do not call shell.openPath()).
Electron (shell.openPath) Embedded null byte path validation = Reject/throw for paths containing '\0' (null byte) before calling shell.openPath()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70603?
The severity of CVE-2026-70603 is classified as medium with a score of 6.
What is the impact of CVE-2026-70603?
CVE-2026-70603 allows attackers to bypass string-only validation of file paths due to the handling of embedded null bytes in paths.
How do I fix CVE-2026-70603?
To fix CVE-2026-70603, ensure that your application properly validates file paths passed to `shell.openPath()` and rejects any paths containing embedded null bytes.
Which software is affected by CVE-2026-70603?
CVE-2026-70603 affects applications built with npm/electron.
What is the nature of the vulnerability in CVE-2026-70603?
CVE-2026-70603 is categorized under Input Validation vulnerabilities, specifically related to path processing.