Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
References
| Link | Resource |
|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Oct 2026, 13:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq - Vendor Advisory | |
| First Time |
Electronjs electron
Electronjs |
|
| CPE | cpe:2.3:a:electronjs:electron:42.0.0:alpha5:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:beta1:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:alpha6:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:beta2:*:*:*:node.js:*:* cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:* |
Information
Published : 2026-08-05 16:17
Updated : 2026-10-08 13:53
NVD link : CVE-2026-70605
Mitre link : CVE-2026-70605
CVE.ORG link : CVE-2026-70605
JSON object : View
Products Affected
electronjs
- electron
CWE
CWE-918
Server-Side Request Forgery (SSRF)