5.3

CVE-2026-70607

Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron SwPlatform node.js Version < 39.8.8
Electronjs ≫ Electron SwPlatform node.js Version >= 40.0.0 < 40.9.0
Electronjs ≫ Electron SwPlatform node.js Version >= 41.0.0 <= 41.2.1
Electronjs ≫ Electron Version 42.0.0 Update alpha1 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update alpha2 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update alpha3 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update alpha4 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update alpha5 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update alpha6 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update beta1 SwPlatform node.js
Electronjs ≫ Electron Version 42.0.0 Update beta2 SwPlatform node.js
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.261
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj
Vendor Advisory
https://github.com/electron/electron/pull/50946
Patch
Issue Tracking
https://github.com/electron/electron/pull/50947
Patch
Issue Tracking
https://github.com/electron/electron/pull/50948
Patch
Issue Tracking
https://github.com/electron/electron/pull/50949
Patch
Issue Tracking
https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a
Patch
https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7
Patch
https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b
Patch
https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55
Patch
https://github.com/electron/electron/releases/tag/v39.8.8
Release Notes
https://github.com/electron/electron/releases/tag/v40.9.0
Release Notes
https://github.com/electron/electron/releases/tag/v41.2.1
Release Notes
https://github.com/electron/electron/releases/tag/v42.0.0-beta.3
Release Notes