The vulnerability in Electron's shell.openPath() arises because it does not reject file paths containing embedded null bytes. Applications that rely solely on string-based validation of file paths (e.g., checking file extensions) before calling shell.openPath() can be bypassed by an attacker supplying a path with an embedded null byte. This causes shell.openPath() to open a different file than the one that passed validation. Node.js filesystem APIs such as fs.existsSync() or fs.stat() already reject null bytes, so applications that perform such checks before calling shell.openPath() are not affected. The issue is fixed in Electron versions 39.8.6 and later.

An attacker who can supply untrusted input to shell.openPath() in an affected Electron application can bypass string-only path validation checks. This may lead to opening unintended files, potentially exposing sensitive information or causing other unintended behavior. The vulnerability does not affect applications that perform filesystem-level validation or do not pass untrusted input to shell.openPath().

A fix is available in Electron versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. Applications should upgrade to one of these versions or later. As a workaround, applications can reject any file path containing a null byte before passing it to shell.openPath(), for example by checking if the path includes '\0' and throwing an error if it does. Applications that perform filesystem checks using Node.js fs APIs before calling shell.openPath() are not affected and do not require additional mitigation.