Vulnerability-Lookup

CVE-2026-70609 (GCVE-0-2026-70609)

Vulnerability from cvelistv5 – Published: 2026-08-05 17:32 – Updated: 2026-08-06 03:55

Title

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M

References

13 references

URL	Tags
https://github.com/electron/electron/security/adv…	x_refsource_CONFIRM
https://github.com/electron/electron/pull/50665	x_refsource_MISC
https://github.com/electron/electron/pull/50666	x_refsource_MISC
https://github.com/electron/electron/pull/50667	x_refsource_MISC
https://github.com/electron/electron/pull/50668	x_refsource_MISC
https://github.com/electron/electron/commit/04614…	x_refsource_MISC
https://github.com/electron/electron/commit/2046a…	x_refsource_MISC
https://github.com/electron/electron/commit/96974…	x_refsource_MISC
https://github.com/electron/electron/commit/efc4d…	x_refsource_MISC
https://github.com/electron/electron/releases/tag…	x_refsource_MISC
https://github.com/electron/electron/releases/tag…	x_refsource_MISC
https://github.com/electron/electron/releases/tag…	x_refsource_MISC
https://github.com/electron/electron/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
electron	electron	Affected: < 39.8.7 Affected: >= 40.0.0-alpha.1, < 40.9.0 Affected: >= 41.0.0-alpha.1, < 41.2.0 Affected: >= 42.0.0-alpha.1, < 42.0.0-beta.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-70609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T03:55:49.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 39.8.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T17:32:21.067Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"
        },
        {
          "name": "https://github.com/electron/electron/pull/50665",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/50665"
        },
        {
          "name": "https://github.com/electron/electron/pull/50666",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/50666"
        },
        {
          "name": "https://github.com/electron/electron/pull/50667",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/50667"
        },
        {
          "name": "https://github.com/electron/electron/pull/50668",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/pull/50668"
        },
        {
          "name": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
        },
        {
          "name": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
        },
        {
          "name": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
        },
        {
          "name": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
        },
        {
          "name": "https://github.com/electron/electron/releases/tag/v39.8.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/releases/tag/v39.8.7"
        },
        {
          "name": "https://github.com/electron/electron/releases/tag/v40.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/releases/tag/v40.9.0"
        },
        {
          "name": "https://github.com/electron/electron/releases/tag/v41.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/releases/tag/v41.2.0"
        },
        {
          "name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4f78-qhmw-8j8m",
        "discovery": "UNKNOWN"
      },
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-70609",
    "datePublished": "2026-08-05T17:32:21.067Z",
    "dateReserved": "2026-08-04T19:50:27.329Z",
    "dateUpdated": "2026-08-06T03:55:49.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-70609",
      "date": "2026-08-09",
      "epss": "0.00322",
      "percentile": "0.24662"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-70609\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-05T18:17:15.307\",\"lastModified\":\"2026-08-06T05:17:09.140\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"electron\",\"product\":\"electron\",\"versions\":[{\"version\":\"\u003c 39.8.7\",\"status\":\"affected\"},{\"version\":\"\u003e= 40.0.0-alpha.1, \u003c 40.9.0\",\"status\":\"affected\"},{\"version\":\"\u003e= 41.0.0-alpha.1, \u003c 41.2.0\",\"status\":\"affected\"},{\"version\":\"\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-05T00:00:00+00:00\",\"id\":\"CVE-2026-70609\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"},{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"references\":[{\"url\":\"https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/pull/50665\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/pull/50666\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/pull/50667\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/pull/50668\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/releases/tag/v39.8.7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/releases/tag/v40.9.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/releases/tag/v41.2.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/releases/tag/v42.0.0-beta.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-70609\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-05T19:34:53.906480Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-05T19:35:10.846Z\"}}], \"cna\": {\"title\": \"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter\", \"source\": {\"advisory\": \"GHSA-4f78-qhmw-8j8m\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"electron\", \"product\": \"electron\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 39.8.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 40.0.0-alpha.1, \u003c 40.9.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 41.0.0-alpha.1, \u003c 41.2.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1\"}]}], \"references\": [{\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m\", \"name\": \"https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/electron/electron/pull/50665\", \"name\": \"https://github.com/electron/electron/pull/50665\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/pull/50666\", \"name\": \"https://github.com/electron/electron/pull/50666\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/pull/50667\", \"name\": \"https://github.com/electron/electron/pull/50667\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/pull/50668\", \"name\": \"https://github.com/electron/electron/pull/50668\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1\", \"name\": \"https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b\", \"name\": \"https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce\", \"name\": \"https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba\", \"name\": \"https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/releases/tag/v39.8.7\", \"name\": \"https://github.com/electron/electron/releases/tag/v39.8.7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/releases/tag/v40.9.0\", \"name\": \"https://github.com/electron/electron/releases/tag/v40.9.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/releases/tag/v41.2.0\", \"name\": \"https://github.com/electron/electron/releases/tag/v41.2.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/electron/electron/releases/tag/v42.0.0-beta.1\", \"name\": \"https://github.com/electron/electron/releases/tag/v42.0.0-beta.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-116\", \"description\": \"CWE-116: Improper Encoding or Escaping of Output\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-05T17:32:21.067Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-70609\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T19:47:53.992Z\", \"dateReserved\": \"2026-08-04T19:50:27.329Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-05T17:32:21.067Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-4F78-QHMW-8J8M

Vulnerability from github – Published: 2026-08-05 17:32 – Updated: 2026-08-05 17:32

Summary

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Details

Impact

The mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js.

Apps are only affected if untrusted input can reach the mode argument of openDevTools(), or if untrusted content can call openDevTools() on a <webview> it embeds. Apps that only ever pass a fixed dock mode are not affected.

Workarounds

Only pass fixed, allowlisted values (right, bottom, undocked, detach) as the DevTools mode, and do not expose openDevTools to untrusted content.

Fixed Versions

42.0.0-beta.1
41.2.0
40.9.0
39.8.7

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "39.8.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "40.0.0-alpha.1"
            },
            {
              "fixed": "40.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "41.0.0-alpha.1"
            },
            {
              "fixed": "41.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "42.0.0-alpha.1"
            },
            {
              "fixed": "42.0.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94",
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T17:32:47Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe `mode` option of `webContents.openDevTools()` was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js.\n\nApps are only affected if untrusted input can reach the `mode` argument of `openDevTools()`, or if untrusted content can call `openDevTools()` on a `\u003cwebview\u003e` it embeds. Apps that only ever pass a fixed dock mode are not affected.\n\n### Workarounds\nOnly pass fixed, allowlisted values (`right`, `bottom`, `undocked`, `detach`) as the DevTools `mode`, and do not expose `openDevTools` to untrusted content.\n\n### Fixed Versions\n* `42.0.0-beta.1`\n* `41.2.0`\n* `40.9.0`\n* `39.8.7`\n\n### For more information\nIf you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-4f78-qhmw-8j8m",
  "modified": "2026-08-05T17:32:47Z",
  "published": "2026-08-05T17:32:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50665"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50666"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50667"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron/electron"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v39.8.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v40.9.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v41.2.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted