CVE-2026-70609: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Impact The mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js.
Apps are only affected if untrusted input can reach the mode argument of openDevTools(), or if untrusted content can call openDevTools() on a <webview> it embeds. Apps that only ever pass a fixed dock mode are not affected.
Workarounds Only pass fixed, allowlisted values (right, bottom, undocked, detach) as the DevTools mode, and do not expose openDevTools to untrusted content.
Fixed Versions 42.0.0-beta.1 41.2.0 40.9.0 39.8.7
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.7 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.7 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.2.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.1 - Configuration
Only pass the fixed, allowlisted values right, bottom, undocked, or detach as the DevTools mode, and do not expose openDevTools() to untrusted content.
Electron webContents.openDevTools() mode = right, bottom, undocked, or detach
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70609?
CVE-2026-70609 has a medium severity rating of 5.7.
How do I fix CVE-2026-70609?
To fix CVE-2026-70609, ensure that the `mode` option of `webContents.openDevTools()` is properly sanitized before use.
What impact does CVE-2026-70609 have on applications?
CVE-2026-70609 allows an attacker to potentially execute scripts in the DevTools context, leading to code injection if unsandboxed.
Which software is affected by CVE-2026-70609?
CVE-2026-70609 affects applications built with the npm/electron framework.
What type of vulnerability is CVE-2026-70609 categorized as?
CVE-2026-70609 is categorized as a Code Injection vulnerability under the CWE classification.