CVE-2026-34767 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3.
A vulnerability allowing HTTP response header injection has been identified in Electron applications that register custom protocol handlers or modify response headers. This issue affects versions of Electron prior to 38.8.6, as well as versions 39.0.0-alpha.1 through 39.8.3, 40.0.0-alpha.1 through 40.8.3, and 41.0.0-alpha.1 through 41.0.3. The vulnerability arises when attacker-controlled input is reflected into a response header name or value, potentially allowing the injection of additional response headers that could impact cookies, content security policy, or cross-origin access controls. Applications that do not reflect external input into response headers are not vulnerable.
Users can update to Electron versions 38.8.6, 39.8.3, 40.8.3, or 41.0.3 to address this vulnerability. For applications that cannot be updated, it is recommended to validate or sanitize any untrusted input before including it in a response header name or value.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-4p4r-m79c-wq3v | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electronjs electron | < 38.8.6 >= 39.0.0, < 39.8.3 >= 40.0.0, < 40.8.3 >= 41.0.0, < 41.0.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 4, 2026 | New CVE Received | [email protected] |