CVE-2026-34779 json
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
published 2026-04-03 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-18957 , GHSA-5rqw-r77c-jp79
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
Patch / fix
- npm electron 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
- atom electron 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
- electronjs electron 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <38.8.6 >=39.0.0-alpha.1, <39.8.1 >=40.0.0-alpha.1, <40.8.0 >=41.0.0-alpha.1, <41.0.0-beta.8 |
38.8.6 39.8.1 40.8.0 41.0.0-beta.8 |
Affected products
- electron electron
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34779
advisory
-
github.com
/electron/electron
package
Sources
- CVE List CVE-2026-34779
- GitHub Advisory GHSA-5rqw-r77c-jp79
- NVD CVE-2026-34779
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.