CVE-2026-70605 Details

A vulnerability exists in Electron versions prior to 39.8.8, 40.0.0-alpha.1 through 40.9.0, 41.0.0-alpha.1 through 41.2.1, and 42.0.0-alpha.1 through 42.0.0-beta.3. When following HTTP redirects, the 'net.fetch()' and 'net.request()' methods did not properly restrict redirect targets, allowing a remote server to redirect requests to local resources. If the application forwards the response body, this could result in the unintentional disclosure of local file contents. This issue affects applications that make 'net' requests to URLs controlled by an attacker, follow redirects (the default behavior), and expose the response body.

Users can update to Electron versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3. For applications that cannot be immediately updated, a temporary workaround is to set the redirect option to 'error' or 'manual' when making requests to untrusted URLs, and to validate any redirect targets before following them.