Skip to main content

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2026-70611

Medium
6.9/10

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version 39.8.9, 40.x prior to 40.9.2, 41.x prior to 41.2.1 and 42.x prior to 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use `showItemInFolder` handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

  • HIGH
  • LOCAL
  • HIGH
  • CHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • NONE

CWE-78 - OS Command Injection

The OS command injection weakness (also known as shell injection) is a vulnerability which enables an attacker to run arbitrary OS commands on a server. This is done by modifying the intended downstream OS command and injecting arbitrary commands, enabling the execution of unauthorized OS commands. This has the potential to fully compromise the application along with all of its data, and, if the compromised process does not follow the principle of least privileges, it may compromise other parts of the hosting infrastructure as well. This weakness is listed as number ten in the 'CWE Top 25 Most Dangerous Software Weaknesses'.

References

Advisory Timeline

  • Published