CVE-2026-70611: Electron: DevTools embedder handler executes arbitrary files via shell open
Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend (such as a malicious DevTools extension) could use this to execute native code outside the sandbox.
Apps are only affected if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. Apps that do not open DevTools in that context are not affected.
Workarounds Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.2 39.8.9
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.9 - Upgrade
Upgrade
Electron (DevTools embedder handler)to a version that resolves this vulnerability.Fixed in 39.8.9 - Upgrade
Upgrade
Electron (DevTools embedder handler)to a version that resolves this vulnerability.Fixed in 40.9.2 - Upgrade
Upgrade
Electron (DevTools embedder handler)to a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
Electron (DevTools embedder handler)to a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Compensating control
Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions (apps are only affected if DevTools is opened in that context).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70611?
CVE-2026-70611 has a medium severity rating of 6.9.
How do I fix CVE-2026-70611?
To fix CVE-2026-70611, upgrade to Electron versions 39.8.9, 40.9.2, 41.2.1, or 42.0.0-beta.3 or later.
What impact does CVE-2026-70611 have on users?
CVE-2026-70611 allows attackers to execute arbitrary files via shell open, which can lead to unauthorized code execution.
What versions of Electron are affected by CVE-2026-70611?
CVE-2026-70611 affects versions of Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Is user interaction required to exploit CVE-2026-70611?
Yes, user interaction is required as the attacker needs a separate means to run the script.