CVE-2026-70611: CVE-2026-70611: Sandbox Escape and Command Execution via DevTools Shell Integration in Electron
CVSS Score: 6.9 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-70611
A high-severity sandbox escape and arbitrary command execution vulnerability exists in the Electron desktop framework prior to versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3. The flaw lies in the handling of DevTools embedder messages during file manager reveal actions, allowing an attacker to execute arbitrary binaries with main process privileges.
Unsanitized file paths sent via DevTools IPC to the main process can trigger arbitrary code execution by exploiting OS shell file launching handlers.
- CWE ID: CWE-78
- Attack Vector: Local (AV:L)
- CVSS Score: 6.9
- EPSS Score: Not Available
- Impact: Sandbox Escape & Arbitrary Code Execution
- Exploit Status: Proof-of-Concept (PoC) documented
- KEV Status: Not Listed
- Electron desktop applications running on Windows
- Electron desktop applications running on macOS
- Electron desktop applications running on Linux
- Electron: < 39.8.9 (Fixed in:
39.8.9) - Electron: >= 40.0.0-alpha.1, < 40.9.2 (Fixed in:
40.9.2) - Electron: >= 41.0.0-alpha.1, < 41.2.1 (Fixed in:
41.2.1) - Electron: >= 42.0.0-alpha.1, < 42.0.0-beta.3 (Fixed in:
42.0.0-beta.3)
- Update Electron dependencies to patched versions (39.8.9+, 40.9.2+, 41.2.1+, 42.0.0-beta.3+).
- Disable DevTools access programmatically in production environments.
- Enforce context isolation, sandboxing, and restrict DevTools extension loading.
Remediation Steps:
- Audit package.json to identify the current Electron version.
- Update Electron dependency using standard package managers (npm install electron@latest or yarn upgrade electron).
- Verify the application build pipeline does not bundle or allow access to DevTools in production targets.
- Implement process creation monitoring to detect execution anomalies originating from Electron parent processes.
- Electron Security Advisory GHSA-f2r8-jv7c-xqmp
- Fix Commit 10fb5b39c5287f70c4bbcab4c24197f3871ec322
- Fix Commit 1b8a298d629d5a642c816ea5f7505359de17b771
- Fix Commit 27bf1cae9274d5025684c7268496f435b7e06b44
- Fix Commit 7a1eb7e5585991b3726cedb890a6244f327f43de
- Pull Request 50937
- Pull Request 50938
- Pull Request 51114
- Pull Request 51115
- Electron Release v39.8.9
- Electron Release v40.9.2
- Electron Release v41.2.1
- Electron Release v42.0.0-beta.3
Generated by CVEReports - Automated Vulnerability Intelligence