Electron: Parent process code-sign check is spoofable (CVE-2026-70597)
On macOS, Electron's parent process code-sign check can be bypassed by a local attacker, allowing them to run code inside a signed app and inherit its TCC permissions and keychain access. This affects apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. Apps not enabling these restrictions are not affected. A patch is available and must be applied to mitigate this issue.
AI Analysis
Technical Summary
CVE-2026-70597 is a vulnerability in Electron on macOS where the mechanism to verify that Electron was launched by a same-signed parent process can be spoofed by a local process. This check is critical for apps that enable fuse-based hardening restricting environment variables ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. By bypassing this check, a local attacker can execute arbitrary code within the context of the signed app, inheriting sensitive permissions such as TCC (Transparency, Consent, and Control) and keychain access. The vulnerability affects Electron versions prior to 39.8.8 and has been fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Potential Impact
A local attacker can bypass the parent process code-sign check on macOS, enabling them to run code inside an Electron app that has enabled specific fuse-based hardening. This allows the attacker to inherit the app's TCC permissions and keychain access, potentially exposing sensitive user data and system controls. Apps not using these hardening features are not impacted.
Mitigation Recommendations
A patch is available and must be applied to affected Electron versions. Update to Electron version 39.8.8 or later (including 40.9.0, 41.2.1, or 42.0.0-beta.3) to remediate this vulnerability. There are no effective workarounds on the app side; updating Electron is required.
Electron: Parent process code-sign check is spoofable (CVE-2026-70597)
Description
On macOS, Electron's parent process code-sign check can be bypassed by a local attacker, allowing them to run code inside a signed app and inherit its TCC permissions and keychain access. This affects apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. Apps not enabling these restrictions are not affected. A patch is available and must be applied to mitigate this issue.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70597 is a vulnerability in Electron on macOS where the mechanism to verify that Electron was launched by a same-signed parent process can be spoofed by a local process. This check is critical for apps that enable fuse-based hardening restricting environment variables ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. By bypassing this check, a local attacker can execute arbitrary code within the context of the signed app, inheriting sensitive permissions such as TCC (Transparency, Consent, and Control) and keychain access. The vulnerability affects Electron versions prior to 39.8.8 and has been fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Potential Impact
A local attacker can bypass the parent process code-sign check on macOS, enabling them to run code inside an Electron app that has enabled specific fuse-based hardening. This allows the attacker to inherit the app's TCC permissions and keychain access, potentially exposing sensitive user data and system controls. Apps not using these hardening features are not impacted.
Mitigation Recommendations
A patch is available and must be applied to affected Electron versions. Update to Electron version 39.8.8 or later (including 40.9.0, 41.2.1, or 42.0.0-beta.3) to remediate this vulnerability. There are no effective workarounds on the app side; updating Electron is required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jm7p-cc5g-qwxx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70597"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a738531bf8831d5394f0747
Added to database: 08/05/2026, 18:47:13 UTC
Last enriched: 08/05/2026, 21:02:09 UTC
Last updated: 08/06/2026, 01:58:28 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.