PT-2026-29999 · Npm · Electron

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-34769

OSV

CVSS v3.1

7.7

High

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Impact

An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.

Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected.

Workarounds

Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.

Fixed Versions

• 41.0.0-beta.8
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, send an email to [e-mail]

Fix

Hidden Functionality

Argument Injection

Weakness Enumeration

CWE-912

CWE-88

Related Identifiers

CVE-2026-34769

GHSA-9WFR-W7MM-PC7F

Affected Products

Electron

References · 3

• https://osv.dev/vulnerability/GHSA-9wfr-w7mm-pc7f · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f · Note