{"id":"CVE-2026-34768","aliases":["GHSA-jfqx-fxh3-c62j"],"url":"https://o3.security/vulnerability/CVE-2026-34768","summary":"Electron: Unquoted executable path in app.setLoginItemSettings on Windows","details":"### Impact\nOn Windows, `app.setLoginItemSettings({openAtLogin: true})` wrote the executable path to the `Run` registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app.\n\nOn a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location.\n\n### Workarounds\nInstall the application to a path without spaces, or to a location where all ancestor directories are protected against unauthorized writes.\n\n### Fixed Versions\n* `41.0.0-beta.8`\n* `40.8.0`\n* `39.8.1`\n* `38.8.6`\n\n### For more information\nIf there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)","published":"2026-04-03T23:44:55.776Z","modified":"2026-08-12T15:33:39.064237Z","cvss":{"score":3.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"electron","fixedVersion":"38.8.6"},{"ecosystem":"npm","name":"electron","fixedVersion":"39.8.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"40.8.0"},{"ecosystem":"npm","name":"electron","fixedVersion":"41.0.0-beta.8"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34768.json"},{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34768"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:33:39.064237Z"}}