Nixpkgs security tracker

Untriaged

Permalink CVE-2026-70603

6.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 3 weeks, 3 days ago Activity log

Created suggestion 3 weeks, 3 days ago

Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.

References

https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx x_refsource_CONFIRM

Affected products

electron

==>= 41.0.0-alpha.1, < 41.1.1
==< 39.8.6
==>= 40.0.0-alpha.1, < 40.9.0
==>= 42.0.0-alpha.1, < 42.0.0-beta.1

Matching in nixpkgs

pkgs.electron

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.electron-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-cash

Bitcoin Cash SPV Wallet

nixos-unstable 4.4.2
- nixpkgs-unstable 4.4.2
- nixos-unstable-small 4.4.2
nixos-26.05 4.4.2
- nixos-26.05-small 4.4.2
- nixpkgs-26.05-darwin 4.4.2

pkgs.electron-mail

Unofficial Election-based ProtonMail desktop client

nixos-unstable 5.3.7
- nixpkgs-unstable 5.3.8
- nixos-unstable-small 5.3.8
nixos-26.05 5.3.7
- nixos-26.05-small 5.3.8
- nixpkgs-26.05-darwin 5.3.8

pkgs.electron-fiddle

Easiest way to get started with Electron

nixos-unstable 0.37.2
- nixpkgs-unstable 0.37.2
- nixos-unstable-small 0.37.2
nixos-26.05 0.37.2
- nixos-26.05-small 0.37.2
- nixpkgs-26.05-darwin 0.37.2

pkgs.electron_38-bin

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron_39-bin

Cross platform desktop application shell

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron_40-bin

Cross platform desktop application shell

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron_41-bin

Cross platform desktop application shell

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron_42-bin

Cross platform desktop application shell

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron_43-bin

Cross platform desktop application shell

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

pkgs.todoist-electron

To-Do List App & Task Manager

nixos-unstable 9.20.0
- nixpkgs-unstable 9.20.0
- nixos-unstable-small 9.20.0
nixos-26.05 9.20.0
- nixos-26.05-small 9.20.0
- nixpkgs-26.05-darwin 9.20.0

pkgs.jitsi-meet-electron

Jitsi Meet desktop application powered by Electron

nixos-unstable 2026.5.0
- nixpkgs-unstable 2026.5.0
- nixos-unstable-small 2026.5.0
nixos-26.05 2026.5.0
- nixos-26.05-small 2026.5.0
- nixpkgs-26.05-darwin 2026.5.0

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.idrisPackages.electron

Electron bindings for Idris

nixos-unstable 2016-03-07
- nixpkgs-unstable 2016-03-07
- nixos-unstable-small 2016-03-07
nixos-26.05 2016-03-07
- nixos-26.05-small 2016-03-07
- nixpkgs-26.05-darwin 2016-03-07

pkgs.electron-chromedriver_38

None

nixos-unstable 38.8.4
- nixpkgs-unstable 38.8.4
nixos-26.05 38.8.4
- nixos-26.05-small 38.8.4
- nixpkgs-26.05-darwin 38.8.4

pkgs.electron-chromedriver_39

WebDriver server for running Selenium tests on Chrome

nixos-unstable 39.8.10
- nixpkgs-unstable 39.8.10
- nixos-unstable-small 39.8.10
nixos-26.05 39.8.10
- nixos-26.05-small 39.8.10
- nixpkgs-26.05-darwin 39.8.10

pkgs.electron-chromedriver_40

WebDriver server for running Selenium tests on Chrome

nixos-unstable 40.10.3
- nixpkgs-unstable 40.10.5
- nixos-unstable-small 40.10.5
nixos-26.05 40.10.5
- nixos-26.05-small 40.10.5
- nixpkgs-26.05-darwin 40.10.5

pkgs.electron-chromedriver_41

WebDriver server for running Selenium tests on Chrome

nixos-unstable 41.7.2
- nixpkgs-unstable 41.9.1
- nixos-unstable-small 41.10.3
nixos-26.05 41.9.1
- nixos-26.05-small 41.9.1
- nixpkgs-26.05-darwin 41.9.1

pkgs.electron-chromedriver_42

WebDriver server for running Selenium tests on Chrome

nixos-unstable 42.4.0
- nixpkgs-unstable 42.5.1
- nixos-unstable-small 42.7.1
nixos-26.05 42.5.1
- nixos-26.05-small 42.5.1
- nixpkgs-26.05-darwin 42.5.1

pkgs.electron-chromedriver_43

WebDriver server for running Selenium tests on Chrome

nixos-unstable -
- nixos-unstable-small 43.2.0
nixos-26.05 -
- nixos-26.05-small 43.1.0

Package maintainers

@yayayayaka Yaya <github@uwu.is>
@teutat3s teutat3s <teutates@mailbox.org>
@TomaSajt TomaSajt
@oxalica oxalica <oxalicc@pm.me>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@liam-murphy14 Liam Murphy <liam.murphy137@gmail.com>
@andersk Anders Kaseorg <andersk@mit.edu>
@BatteredBunny BatteredBunny <ayes2022@protonmail.com>
@Princemachiavelli Josh Hoffer <jhoffer@sansorgan.es>
@brainrake Marton Boros <martonboros@gmail.com>
@Lassulus Lassulus <lassulus@gmail.com>
@novmar Marcel Novotny <novotny@marnov.cz>
@ryantm Ryan Mulligan <ryan@ryantm.com>
@kylesferrazza Kyle Sferrazza <nixpkgs@kylesferrazza.com>
@pokon548 Bu Kun <nix@bukn.uk>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.electron

pkgs.electron_38

pkgs.electron_39

pkgs.electron_40

pkgs.electron_41

pkgs.electron_42

pkgs.electron_43

pkgs.electron-bin

pkgs.electron-cash

pkgs.electron-mail

pkgs.electron-fiddle

pkgs.electron_38-bin

pkgs.electron_39-bin

pkgs.electron_40-bin

pkgs.electron_41-bin

pkgs.electron_42-bin

pkgs.electron_43-bin

pkgs.todoist-electron

pkgs.jitsi-meet-electron

pkgs.electron-chromedriver

pkgs.idrisPackages.electron

pkgs.electron-chromedriver_38

pkgs.electron-chromedriver_39

pkgs.electron-chromedriver_40

pkgs.electron-chromedriver_41

pkgs.electron-chromedriver_42

pkgs.electron-chromedriver_43

Package maintainers