High severity · published Apr 3, 2026
CVE-2026-34769
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 38.8.6; >= 39.0.0-alpha.1, < 39.8.0; >= 40.0.0-alpha.1, < 40.7.0; >= 41.0.0-alpha.1, < 41.0.0-beta.8 · source: vendor, NVD
RH
Red Hat Build of Podman Desktop · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Build of Podman Desktop - Tech Preview · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34769
Vendor Advisory
https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-34769
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2455004
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34769.json
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
8.8
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context