Review reviewHigh

CVE-2026-34779

electron

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue...

CVSS: 7.8
EPSS: 0.16%
CISA KEV: Not listed
Published: 2026.04.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.16%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: electron
Affected versions: >= < 38.8.6, >= >= 39.0.0-alpha.1, < 39.8.1, >= >= 40.0.0-alpha.1, < 40.8.0, >= >= 41.0.0-alpha.1, < 41.0.0-beta.8, < 38.8.6, >= 39.0.0 < 39.8.1, >= 40.0.0 < 40.8.0, 41.0.0
Fixed versions: 38.8.6, 39.8.1, 40.8.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that electron and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-78