{"id":"CVE-2026-34768","aliases":["GHSA-jfqx-fxh3-c62j"],"url":"https://o3.security/vulnerability/CVE-2026-34768","summary":"Electron: Unquoted executable path in app.setLoginItemSettings on Windows","details":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","published":"2026-04-03T23:44:55.776Z","modified":"2026-08-07T21:53:41.092724Z","cvss":{"score":3.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"electron","fixedVersion":"38.8.6"},{"ecosystem":"npm","name":"electron","fixedVersion":"39.8.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"40.8.0"},{"ecosystem":"npm","name":"electron","fixedVersion":"41.0.0-beta.8"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34768.json"},{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34768"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T21:53:41.092724Z"}}