Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-70603
6.0 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 1 month, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 1 month, 2 weeks ago
  • @LeSuisse ignored
    25 packages
    • electron
    • electron_39
    • electron_40
    • electron_41
    • electron_42
    • electron_43
    • electron-bin
    • electron-cash
    • electron-mail
    • electron-fiddle
    • electron_39-bin
    • electron_40-bin
    • electron_41-bin
    • electron_42-bin
    • electron_43-bin
    • todoist-electron
    • jitsi-meet-electron
    • electron-chromedriver
    • idrisPackages.electron
    • electron-chromedriver_38
    • electron-chromedriver_39
    • electron-chromedriver_40
    • electron-chromedriver_41
    • electron-chromedriver_42
    • electron-chromedriver_43
    1 month, 2 weeks ago
  • @LeSuisse dismissed 1 month, 2 weeks ago
Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.

Affected products

electron
  • ==>= 41.0.0-alpha.1, < 41.1.1
  • ==>= 42.0.0-alpha.1, < 42.0.0-beta.1
  • ==< 39.8.6
  • ==>= 40.0.0-alpha.1, < 40.9.0

Matching in nixpkgs

Ignored packages (25)

pkgs.electron_43

Cross platform desktop application shell

  • nixos-unstable -
  • nixos-26.05 -

pkgs.electron_43-bin

Cross platform desktop application shell

  • nixos-unstable -
  • nixos-26.05 - 
All supported versions have been updated