CVE-2026-70609 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
A vulnerability exists in Electron's DevTools integration, specifically in versions prior to 39.8.7, 40.0.0-alpha.1 through 40.9.0, 41.0.0-alpha.1 through 41.2.0, and 42.0.0-alpha.1 through 42.0.0-beta.1. The issue arises because the 'mode' option in 'webContents.openDevTools()' was not properly sanitized before being used by the DevTools frontend. This lack of validation can allow an attacker to execute scripts in the DevTools context, which, in unsandboxed environments, has access to Node.js. The vulnerability can be exploited if untrusted input is allowed to reach the 'mode' argument of 'openDevTools()', or if untrusted content can invoke 'openDevTools()' on an embedded webview.
Users can update to Electron versions 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |