PT-2026-29999 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34769

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, prior to 39.8.0, prior to 40.7.0, and prior to 41.0.0-beta.8.

Description An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Applications that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Applications are only affected if they construct webPreferences from external or untrusted input without an allowlist. Applications that use a fixed, hardcoded webPreferences object are not affected.

Recommendations Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.

Fix

Hidden Functionality

Argument Injection

Weakness Enumeration

CWE-912

CWE-88

Related Identifiers

CVE-2026-34769

GHSA-9WFR-W7MM-PC7F

Affected Products

Electron

References · 7

• https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9wfr-w7mm-pc7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34769 · Security Note
• https://github.com/electron/electron · Note
• https://twitter.com/CVEnew/status/2040481274352357698 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040482553069457570 · Twitter Post
• https://twitter.com/SeedVEVO/status/2039982997689286963 · Twitter Post