CVE-2026-70603

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.6 Electron versions prior to 40.9.0 Electron versions prior to 41.1.1 Electron versions prior to 42.0.0-beta.1

Description The shell.openPath() function does not reject paths containing embedded null bytes. This allows an attacker to bypass string-only validation of file paths, such as file extension checks, by providing a path that opens a different file than the one validated. This issue occurs when applications pass untrusted input to shell.openPath() and rely on string-based validation without performing a filesystem check. Applications that use Node fs APIs, such as fs.existsSync() or fs.stat(), before calling the function are not affected because those APIs already reject null bytes.

Recommendations Update to version 39.8.6. Update to version 40.9.0. Update to version 41.1.1. Update to version 42.0.0-beta.1. As a temporary workaround, reject any path containing a null byte before passing it to the shell.openPath() function.