Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVE-2026-70609)
A vulnerability in Electron allows JavaScript injection in the DevTools frontend via an unsanitized 'mode' parameter passed to webContents.openDevTools(). This can lead to script execution in the DevTools context, which may have Node.js access in unsandboxed configurations. The issue affects applications that allow untrusted input to influence the 'mode' argument or permit untrusted content to call openDevTools on embedded webviews. Fixed versions are 39.8.7 and later.
AI Analysis
Technical Summary
The 'mode' option of Electron's webContents.openDevTools() was not sanitized before being used by the DevTools frontend. If an attacker can control this parameter, they may execute arbitrary JavaScript in the DevTools context. In unsandboxed Electron apps, this context has access to Node.js APIs, increasing the potential impact. The vulnerability only affects apps where untrusted input can reach the 'mode' argument or untrusted content can invoke openDevTools on embedded webviews. Electron fixed this issue in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Potential Impact
Successful exploitation allows an attacker to run arbitrary JavaScript in the DevTools context, which in unsandboxed Electron applications can access Node.js APIs, potentially leading to code execution or other high-impact outcomes. The vulnerability requires the attacker to influence the 'mode' parameter or call openDevTools on a webview with untrusted content. The CVSS 3.1 score is 5.7 (medium severity), reflecting the need for some privileges and user interaction.
Mitigation Recommendations
A fix is available in Electron versions 39.8.7 and later. Applications should upgrade to these or newer versions. As a workaround, only pass fixed, allowlisted values ('right', 'bottom', 'undocked', 'detach') to the DevTools 'mode' parameter and avoid exposing openDevTools to untrusted content. Following these mitigations prevents exploitation of this vulnerability.
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVE-2026-70609)
Description
A vulnerability in Electron allows JavaScript injection in the DevTools frontend via an unsanitized 'mode' parameter passed to webContents.openDevTools(). This can lead to script execution in the DevTools context, which may have Node.js access in unsandboxed configurations. The issue affects applications that allow untrusted input to influence the 'mode' argument or permit untrusted content to call openDevTools on embedded webviews. Fixed versions are 39.8.7 and later.
CVSS v3.1
Score 5.7medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'mode' option of Electron's webContents.openDevTools() was not sanitized before being used by the DevTools frontend. If an attacker can control this parameter, they may execute arbitrary JavaScript in the DevTools context. In unsandboxed Electron apps, this context has access to Node.js APIs, increasing the potential impact. The vulnerability only affects apps where untrusted input can reach the 'mode' argument or untrusted content can invoke openDevTools on embedded webviews. Electron fixed this issue in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Potential Impact
Successful exploitation allows an attacker to run arbitrary JavaScript in the DevTools context, which in unsandboxed Electron applications can access Node.js APIs, potentially leading to code execution or other high-impact outcomes. The vulnerability requires the attacker to influence the 'mode' parameter or call openDevTools on a webview with untrusted content. The CVSS 3.1 score is 5.7 (medium severity), reflecting the need for some privileges and user interaction.
Mitigation Recommendations
A fix is available in Electron versions 39.8.7 and later. Applications should upgrade to these or newer versions. As a workaround, only pass fixed, allowlisted values ('right', 'bottom', 'undocked', 'detach') to the DevTools 'mode' parameter and avoid exposing openDevTools to untrusted content. Following these mitigations prevents exploitation of this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4f78-qhmw-8j8m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70609"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a738519bf8831d5394eedc6
Added to database: 08/05/2026, 18:46:49 UTC
Last enriched: 08/05/2026, 23:34:04 UTC
Last updated: 08/05/2026, 23:34:04 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.