CVE-2026-34779: Electron Framework RCE Vulnerability

CVE-2026-34779 Overview

CVE-2026-34779 is a Command Injection vulnerability affecting the Electron framework, which is widely used for building cross-platform desktop applications using JavaScript, HTML, and CSS. The vulnerability exists in the app.moveToApplicationsFolder() API on macOS, where an AppleScript fallback path fails to properly sanitize certain characters in the application bundle path. When a user accepts the move-to-Applications prompt under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution.

Critical Impact

Attackers can achieve arbitrary code execution on macOS systems by exploiting improper input sanitization in the AppleScript fallback mechanism, potentially compromising user systems when they interact with seemingly benign prompts.

Affected Products

• Electron versions prior to 38.8.6
• Electron versions prior to 39.8.1
• Electron versions prior to 40.8.0
• Electron versions prior to 41.0.0-beta.8

Discovery Timeline

• 2026-04-04 - CVE CVE-2026-34779 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34779

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as Command Injection. The flaw resides in the macOS-specific implementation of Electron's app.moveToApplicationsFolder() function.

When the primary method for moving an application to the Applications folder fails, Electron falls back to using AppleScript to perform the operation. The vulnerable code path does not properly escape or sanitize special characters present in the application bundle path before incorporating them into the AppleScript command. This creates an injection point where specially crafted path components can break out of the intended AppleScript context and execute arbitrary commands.

The attack requires local access and user interaction (the user must accept the move-to-Applications prompt), which limits the attack surface but still presents a significant risk for desktop applications built with Electron.

Root Cause

The root cause is insufficient input validation and improper sanitization of the application bundle path when constructing AppleScript commands. The AppleScript fallback mechanism concatenates the path directly into the script without properly escaping characters that have special meaning in AppleScript syntax, such as quotes, backslashes, or other metacharacters.

Attack Vector

The attack vector is local and requires specific conditions to be met:

1. The target application must be an Electron-based app that calls app.moveToApplicationsFolder()
2. The application must be launched from a path containing specially crafted characters
3. The user must accept the prompt to move the application to the Applications folder
4. The primary move operation must fail, triggering the vulnerable AppleScript fallback

An attacker could distribute a malicious Electron application or trick a user into launching a legitimate Electron application from a specially crafted directory path. When the move operation fails and falls back to AppleScript, the injected commands would execute with the user's privileges.

The vulnerability mechanism involves path manipulation that injects AppleScript commands. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-34779

Indicators of Compromise

• Unusual AppleScript process executions (osascript) spawned by Electron-based applications
• Applications being launched from directories with unusual or suspicious characters in the path
• Unexpected child processes spawned during application installation or relocation workflows

Detection Strategies

• Monitor for osascript process executions with command-line arguments containing suspicious patterns or escaped characters
• Implement application allowlisting to detect Electron applications running from non-standard locations
• Use endpoint detection to identify anomalous process hierarchies where Electron apps spawn unexpected AppleScript commands
• Review logs for Finder or system operations involving application moves with unusual path patterns

Monitoring Recommendations

• Enable process creation auditing on macOS endpoints to capture full command-line arguments
• Deploy behavioral detection rules that flag AppleScript execution with embedded shell commands
• Monitor for applications being executed from user-controlled directories with special characters in paths
• Implement SentinelOne's behavioral AI to detect anomalous script execution patterns from desktop applications

How to Mitigate CVE-2026-34779

Immediate Actions Required

• Update all Electron-based applications to use Electron version 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8 or later
• Audit your Electron applications to determine if they use the app.moveToApplicationsFolder() API
• If updating is not immediately possible, consider temporarily disabling the move-to-Applications functionality
• Educate users about the risks of running applications from untrusted or unusually named directories

Patch Information

Electron has released patched versions that properly sanitize the application bundle path before incorporating it into AppleScript commands. The following versions contain the fix:

• Electron 38.8.6
• Electron 39.8.1
• Electron 40.8.0
• Electron 41.0.0-beta.8

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Remove or disable calls to app.moveToApplicationsFolder() in your Electron application until patching is possible
• Applications that do not use this API are not affected and require no action
• Pre-install applications directly to the Applications folder to avoid triggering the move functionality
• Implement application distribution methods that don't rely on the move-to-Applications workflow

# Check Electron version in your application
npm list electron

# Update to a patched version
npm update electron@38.8.6
# or for specific branches:
npm update electron@39.8.1
npm update electron@40.8.0