MEDIUM 5.7 GitHub
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
### Impact
The `mode` option of `webContents.openDevTools()` was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js.
Apps are only affected if untrusted input can reach the `mode` argument of `openDevTools()`, or if untrusted content can call `openDevTools()` on a `<webview>` it embeds. Apps that only ever pass a fixed dock mode are not a
Affected Products
- npm/electron < 39.8.7
- npm/electron >= 40.0.0-alpha.1, < 40.9.0
- npm/electron >= 41.0.0-alpha.1, < 41.2.0
- npm/electron >= 42.0.0-alpha.1, < 42.0.0-beta.1
References
- https://github.com/advisories/GHSA-4f78-qhmw-8j8m
- https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m
- https://github.com/electron/electron/pull/50665
- https://github.com/electron/electron/pull/50666
This medium severity vulnerability with a CVSS score of 5.7 was published on 2026-08-05 via GitHub. Affected: npm/electron < 39.8.7, npm/electron >= 40.0.0-alpha.1, < 40.9.0, npm/electron >= 41.0.0-alpha.1, < 41.2.0 and 1 more.
vulnfeed aggregates 9316 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.