PT-2026-30003 · Electron · Electron

Vertedindep · Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34773

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0

Description On Windows, the app.setAsDefaultProtocolClient(protocol) function did not validate the protocol name before writing to the registry. Passing untrusted input as the protocol name could allow an attacker to write to arbitrary subkeys under HKCUSoftwareClasses, potentially hijacking existing protocol handlers. Applications are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Applications using a hardcoded protocol name are not affected.

Recommendations Versions prior to 38.8.6: Upgrade to version 38.8.6 or later. Versions prior to 39.8.1: Upgrade to version 39.8.1 or later. Versions prior to 40.8.1: Upgrade to version 40.8.1 or later. Versions prior to 41.0.0: Upgrade to version 41.0.0 or later. As a workaround, validate the protocol name matches /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient().

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-20

CWE-74

Related Identifiers

CVE-2026-34773

GHSA-MWMH-MQ4G-G6GR

Affected Products

Electron

References · 6

• https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mwmh-mq4g-g6gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34773 · Security Note
• https://github.com/electron/electron · Note
• https://twitter.com/infoflowcloud/status/2040482422211461594 · Twitter Post
• https://twitter.com/CVEnew/status/2040481266433491221 · Twitter Post