Nixpkgs security tracker

Untriaged

Permalink CVE-2026-70611

6.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 2 weeks, 3 days ago Activity log

Created suggestion 2 weeks, 3 days ago

Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

References

https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp x_refsource_CONFIRM
https://github.com/electron/electron/pull/50937 x_refsource_MISC
https://github.com/electron/electron/pull/50938 x_refsource_MISC
https://github.com/electron/electron/pull/51114 x_refsource_MISC
https://github.com/electron/electron/pull/51115 x_refsource_MISC
https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322 x_refsource_MISC
https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771 x_refsource_MISC
https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44 x_refsource_MISC
https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de x_refsource_MISC
https://github.com/electron/electron/releases/tag/v39.8.9 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v40.9.2 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v41.2.1 x_refsource_MISC
https://github.com/electron/electron/releases/tag/v42.0.0-beta.3 x_refsource_MISC

Affected products

electron

==>= 40.0.0-alpha.1, < 40.9.2
==>= 41.0.0-alpha.1, < 41.2.1
==< 39.8.9
==>= 42.0.0-alpha.1, < 42.0.0-beta.3

Matching in nixpkgs

pkgs.electron

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.electron-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-cash

Bitcoin Cash SPV Wallet

nixos-unstable 4.4.2
- nixpkgs-unstable 4.4.2
- nixos-unstable-small 4.4.2
nixos-26.05 4.4.2
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.4.2

pkgs.electron-mail

Unofficial Election-based ProtonMail desktop client

nixos-unstable 5.3.7
- nixpkgs-unstable 5.3.7
- nixos-unstable-small 5.3.8
nixos-26.05 5.3.7
- nixos-26.05-small 5.3.8
- nixpkgs-26.05-darwin 5.3.7

pkgs.electron-fiddle

Easiest way to get started with Electron

nixos-unstable 0.37.2
- nixpkgs-unstable 0.37.2
- nixos-unstable-small 0.37.2
nixos-26.05 0.37.2
- nixos-26.05-small 0.37.2
- nixpkgs-26.05-darwin 0.37.2

pkgs.electron_38-bin

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39-bin

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40-bin

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42-bin

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43-bin

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.todoist-electron

To-Do List App & Task Manager

nixos-unstable 9.20.0
- nixpkgs-unstable 9.20.0
- nixos-unstable-small 9.20.0
nixos-26.05 9.20.0
- nixos-26.05-small 9.20.0
- nixpkgs-26.05-darwin 9.20.0

pkgs.jitsi-meet-electron

Jitsi Meet desktop application powered by Electron

nixos-unstable 2026.5.0
- nixpkgs-unstable 2026.5.0
- nixos-unstable-small 2026.5.0
nixos-26.05 2026.5.0
- nixos-26.05-small 2026.5.0
- nixpkgs-26.05-darwin 2026.5.0

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.idrisPackages.electron

Electron bindings for Idris

nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07

pkgs.electron-chromedriver_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron-chromedriver_39

WebDriver server for running Selenium tests on Chrome

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron-chromedriver_40

WebDriver server for running Selenium tests on Chrome

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.3
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.3
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron-chromedriver_41

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.7.2
- nixos-unstable-small 41.10.3
nixos-26.05 41.7.2
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-chromedriver_42

WebDriver server for running Selenium tests on Chrome

nixos-unstable 42.4.0
- nixpkgs-unstable 42.4.0
- nixos-unstable-small 42.7.1
nixos-26.05 42.4.0
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron-chromedriver_43

WebDriver server for running Selenium tests on Chrome

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

Package maintainers

@TomaSajt TomaSajt
@yayayayaka Yaya <github@uwu.is>
@teutat3s teutat3s <teutates@mailbox.org>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@oxalica oxalica <oxalicc@pm.me>
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
@andersk Anders Kaseorg <andersk@mit.edu>
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
@brainrake Marton Boros <martonboros@gmail.com>
@ryantm Ryan Mulligan <ryan@ryantm.com>
@Lassulus Lassulus <lassulus@gmail.com>
@novmar Marcel Novotny <novotny@marnov.cz>
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
@pokon548 Bu Kun <nix@bukn.uk>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.electron

pkgs.electron_38

pkgs.electron_39

pkgs.electron_40

pkgs.electron_41

pkgs.electron_42

pkgs.electron_43

pkgs.electron-bin

pkgs.electron-cash

pkgs.electron-mail

pkgs.electron-fiddle

pkgs.electron_38-bin

pkgs.electron_39-bin

pkgs.electron_40-bin

pkgs.electron_41-bin

pkgs.electron_42-bin

pkgs.electron_43-bin

pkgs.todoist-electron

pkgs.jitsi-meet-electron

pkgs.electron-chromedriver

pkgs.idrisPackages.electron

pkgs.electron-chromedriver_38

pkgs.electron-chromedriver_39

pkgs.electron-chromedriver_40

pkgs.electron-chromedriver_41

pkgs.electron-chromedriver_42

pkgs.electron-chromedriver_43

Package maintainers