PT-2026-29998 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34768

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8

Description On Windows, the app.setLoginItemSettings({openAtLogin: true}) function writes the executable path to the Run registry key without proper quoting. If the application is installed in a path containing spaces, an attacker with write access to an ancestor directory could potentially replace the intended application with a different executable that runs at login. Exploitation typically requires a non-standard installation location, as standard system directories are usually protected against unauthorized writes by standard users.

Recommendations Versions prior to 38.8.6: Update to version 38.8.6 or later. Versions prior to 39.8.1: Update to version 39.8.1 or later. Versions prior to 40.8.0: Update to version 40.8.0 or later. Versions prior to 41.0.0-beta.8: Update to version 41.0.0-beta.8 or later. As a workaround, install the application to a path without spaces or to a location where all ancestor directories are protected against unauthorized writes.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2026-34768

GHSA-JFQX-FXH3-C62J

Affected Products

Electron

References · 6

• https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34768 · Security Note
• https://osv.dev/vulnerability/GHSA-jfqx-fxh3-c62j · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/VulmonFeeds/status/2040345433898168708 · Twitter Post
• https://twitter.com/CVEnew/status/2040481271349215508 · Twitter Post