PT-2026-30009 · Npm · Electron

Published

2026-04-03

·

Updated

2026-04-03

·

CVE-2026-34779

CVSS v3.1

6.5

Medium

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Impact

On macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.
Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions

  • 41.0.0-beta.8
  • 40.8.0
  • 39.8.1
  • 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34779
GHSA-5RQW-R77C-JP79

Affected Products

Electron