CVE-2026-70603 Details

A vulnerability exists in Electron versions prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, where the shell.openPath() function failed to properly handle paths containing embedded null bytes. This oversight allowed applications that relied solely on string-based validation of file paths—such as those checking file extensions—to be manipulated. An attacker could craft a path that bypassed validation, leading to the opening of a different file than intended. The issue affects applications that pass untrusted input-derived paths to shell.openPath() without performing a filesystem check, as Node's fs APIs reject null byte-containing paths. However, apps that validate paths through fs methods before using shell.openPath() are not vulnerable.

To address this vulnerability, update Electron to version 39.8.6, 40.9.0, 41.1.1, or 42.0.0-beta.1. If an immediate update is not possible, reject any paths containing null bytes before passing them to shell.openPath().