CVE-2026-34769— Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
Source: NVD (National Vulnerability Database)
Vulnerability Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
参数注入或修改
Source: NVD (National Vulnerability Database)
Vulnerability Title
Electron 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Electron是Electron开源的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron 38.8.6之前版本、39.8.0之前版本、40.7.0之前版本和41.0.0-beta.8之前版本存在安全漏洞，该漏洞源于未记录的commandLineSwitches webPreference允许向渲染器进程命令行追加任意开关，可能导致禁用渲染器沙箱或Web安全控制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-34769
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34769
请登录查看更多情报信息。
Same Patch Batch · electron · 2026-04-03 · 13 CVEs total
| CVE-2026-34774 | 8.1 HIGH | Electron: Use-after-free in offscreen child window paint callback |
| CVE-2026-34771 | 7.5 HIGH | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permis |
| CVE-2026-34770 | 7.0 HIGH | Electron: Use-after-free in PowerMonitor on Windows and macOS |
| CVE-2026-34775 | 6.8 MEDIUM | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes |
| CVE-2026-34767 | 5.9 MEDIUM | Electron: HTTP Response Header Injection in custom protocol handlers and webRequest |
| CVE-2026-34778 | 5.9 MEDIUM | Electron: Service worker can spoof executeJavaScript IPC replies |
| CVE-2026-34772 | 5.8 MEDIUM | Electron: Use-after-free in download save dialog callback |
| CVE-2026-34777 | 5.4 MEDIUM | Electron: Incorrect origin passed to permission request handler for iframe requests |
| CVE-2026-34776 | 5.3 MEDIUM | Electron: Out-of-bounds read in second-instance IPC on macOS and Linux |
| CVE-2026-34773 | 4.7 MEDIUM | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows |
| CVE-2026-34768 | 3.9 LOW | Electron: Unquoted executable path in app.setLoginItemSettings on Windows |
| CVE-2026-34766 | 3.3 LOW | Electron: USB device selection not validated against filtered device list |
IV. Related Vulnerabilities
Same product: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
Same vendor: electron
- CVE-2026-34781
Electron crashes in clipboard.readImage() on malformed clipb - CVE-2026-34765
Electron named window.open targets not scoped to the opener' - CVE-2026-34764
Electron has a use-after-free in offscreen shared texture re - CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFr - CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFol
Same weakness: CWE-88
- CVE-2026-45181
IDA Pro 9.2/9.3插件目录代码注入漏洞 - CVE-2026-42601
ArchiveBox Vulnerable to RCE via unvalidated per-crawl confi - CVE-2026-43941
Unvalidated shell.openExternal in electerm allows arbitrary - CVE-2026-42284
GitPython: Unsafe option check validates multi_options befor - CVE-2026-40281
Gotenberg vulnerable to argument injection via newlines in E
V. Comments for CVE-2026-34769
No comments yet