CVE-2026-70605

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3

Description When following HTTP redirects, the net.fetch() and net.request() functions do not restrict the schemes a redirect can target. This allows a remote server to redirect a request to a local resource. If the application returns or forwards the response body, local file contents could be disclosed. This issue affects applications that make network requests to attacker-influenced URLs with redirects enabled and expose the response body.

Recommendations Update to version 39.8.8. Update to version 40.9.0. Update to version 41.2.1. Update to version 42.0.0-beta.3. Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.