Electron: DevTools embedder handler executes arbitrary files via shell open (CVE-2026-70611)
A vulnerability in Electron's DevTools allows the 'reveal in file manager' action to execute arbitrary files instead of just revealing them. This can be exploited if an attacker can run scripts inside the DevTools frontend, such as via a malicious DevTools extension. Only applications that open DevTools on windows displaying untrusted content or load untrusted DevTools extensions are affected. Fixed versions are 39.8.9 and later.
AI Analysis
Technical Summary
CVE-2026-70611 is a moderate severity vulnerability in Electron where the DevTools 'reveal in file manager' feature can be abused to launch arbitrary files rather than simply revealing them. This enables an attacker who has a separate method to execute scripts within the DevTools frontend—such as through a malicious DevTools extension—to execute native code outside the sandbox. The vulnerability affects Electron versions prior to 39.8.9 and is mitigated by not opening DevTools on windows that load untrusted content or by avoiding untrusted DevTools extensions. Official fixes are available in Electron versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Potential Impact
An attacker with the ability to run scripts inside the DevTools frontend can leverage this vulnerability to execute native code outside the sandbox, potentially compromising the host system. The impact is limited to applications that open DevTools on windows exposed to untrusted content or load untrusted DevTools extensions. Confidentiality and integrity can be fully compromised (CVSS impact: High), but availability is not affected.
Mitigation Recommendations
A fix is available in Electron versions 39.8.9 and later. Users should upgrade to one of these fixed versions. As a workaround, avoid opening DevTools for windows that load untrusted content and do not load untrusted DevTools extensions. These mitigations reduce the risk until the update is applied.
Electron: DevTools embedder handler executes arbitrary files via shell open (CVE-2026-70611)
Description
A vulnerability in Electron's DevTools allows the 'reveal in file manager' action to execute arbitrary files instead of just revealing them. This can be exploited if an attacker can run scripts inside the DevTools frontend, such as via a malicious DevTools extension. Only applications that open DevTools on windows displaying untrusted content or load untrusted DevTools extensions are affected. Fixed versions are 39.8.9 and later.
CVSS v3.1
Score 6.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70611 is a moderate severity vulnerability in Electron where the DevTools 'reveal in file manager' feature can be abused to launch arbitrary files rather than simply revealing them. This enables an attacker who has a separate method to execute scripts within the DevTools frontend—such as through a malicious DevTools extension—to execute native code outside the sandbox. The vulnerability affects Electron versions prior to 39.8.9 and is mitigated by not opening DevTools on windows that load untrusted content or by avoiding untrusted DevTools extensions. Official fixes are available in Electron versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Potential Impact
An attacker with the ability to run scripts inside the DevTools frontend can leverage this vulnerability to execute native code outside the sandbox, potentially compromising the host system. The impact is limited to applications that open DevTools on windows exposed to untrusted content or load untrusted DevTools extensions. Confidentiality and integrity can be fully compromised (CVSS impact: High), but availability is not affected.
Mitigation Recommendations
A fix is available in Electron versions 39.8.9 and later. Users should upgrade to one of these fixed versions. As a workaround, avoid opening DevTools for windows that load untrusted content and do not load untrusted DevTools extensions. These mitigations reduce the risk until the update is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f2r8-jv7c-xqmp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70611"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a738518bf8831d5394eec31
Added to database: 08/05/2026, 18:46:48 UTC
Last enriched: 08/05/2026, 23:45:53 UTC
Last updated: 08/05/2026, 23:45:53 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.