CVE-2026-70605: Electron Information Disclosure Vulnerability

CVE-2026-70605 Overview

CVE-2026-70605 is a Server-Side Request Forgery (SSRF) vulnerability in Electron, a framework for building cross-platform desktop applications with JavaScript, HTML, and CSS. The net.fetch() and net.request() APIs did not restrict which URL schemes an HTTP redirect could target. A remote server can redirect a request to a local resource such as file://, and if the application returns or forwards the response body, local file contents may be disclosed. Applications are only affected when they issue net requests to attacker-influenced URLs, follow redirects, and expose the response body to the attacker.

Critical Impact
Remote attackers can coerce vulnerable Electron applications into reading local files via redirect chains, leading to disclosure of sensitive file contents on the host system.

Affected Products

Electron versions prior to 39.8.8
Electron versions prior to 40.9.0 and 41.2.1
Electron 42.0.0-beta versions prior to 42.0.0-beta.3

Discovery Timeline

2026-08-05 - CVE-2026-70605 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70605

Vulnerability Analysis

Electron's net module exposes net.fetch() and net.request() for making HTTP requests from the main process. When these APIs follow HTTP redirects, they previously did not validate the scheme of the redirect target. An attacker-controlled HTTP server can respond with a 3xx status code and a Location header pointing to a non-HTTP scheme, such as file:///etc/passwd or another privileged local resource. The Electron networking layer follows the redirect and reads the referenced resource.

This behavior classifies as SSRF under [CWE-918]. The exploit path requires an application that both follows redirects on attacker-influenced URLs and returns the response body back to the attacker, either directly or by forwarding it into a renderer or remote channel.

Root Cause

The root cause is missing scheme validation in the redirect-handling logic of the net.fetch() and net.request() implementations. The redirect follower treated any URL in Location as valid without enforcing a scheme allowlist that excludes local schemes like file:.

Attack Vector

The attack proceeds over the network. An attacker hosts a URL that the target application fetches, then responds with an HTTP redirect whose Location header references a local file URI. The Electron client transparently follows the redirect, reads the local file, and returns its contents in the response body. When the application surfaces that body, the attacker retrieves the file contents. Exploitation requires the specific application pattern of fetching attacker-influenced URLs with redirect following enabled and body exposure.

See the Electron GitHub Security Advisory GHSA-v64r-4m7r-3mvq for full technical details.

Detection Methods for CVE-2026-70605

Indicators of Compromise

Outbound HTTP requests from Electron applications followed by unexpected access to local files referenced by file:// URIs.
HTTP responses containing Location headers with non-HTTP schemes such as file:, chrome:, or other privileged schemes.
Application logs showing response bodies that contain contents of local configuration files, credentials, or system files.

Detection Strategies

Inspect network traffic from Electron-based desktop clients for 3xx responses whose Location header does not begin with http:// or https://.
Audit application source code for calls to net.fetch() and net.request() that both accept user-supplied URLs and return response bodies to callers.
Correlate process telemetry showing Electron processes reading unusual local files shortly after outbound HTTP activity.

Monitoring Recommendations

Log all URLs fetched by net.fetch() and net.request(), including intermediate redirect targets, for forensic review.
Monitor for anomalous file reads by Electron application processes and correlate them with recent network activity.
Alert on network egress from desktop clients to untrusted domains that return redirect responses.

How to Mitigate CVE-2026-70605

Immediate Actions Required

Upgrade Electron to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 or later.
Rebuild and redistribute all downstream Electron-based applications with the patched runtime.
Audit application code for any pattern that fetches attacker-influenced URLs and exposes response bodies.

Patch Information

The issue is fixed in Electron versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. The patch restricts the schemes that net.fetch() and net.request() will follow during HTTP redirects. Refer to the Electron Security Advisory GHSA-v64r-4m7r-3mvq for release notes.

Workarounds

Disable redirect following on net.fetch() and net.request() calls by setting the redirect option to manual or error and validating each redirect target before proceeding.
Reject any redirect whose target URL does not use http: or https: scheme.
Avoid returning or forwarding response bodies from net requests made to user-influenced URLs.

bash

# Configuration example - validate redirect scheme before following
# In your Electron main process code:
#   const response = await net.fetch(userUrl, { redirect: 'manual' });
#   if (response.status >= 300 && response.status < 400) {
#     const location = response.headers.get('location');
#     const target = new URL(location, userUrl);
#     if (target.protocol !== 'https:' && target.protocol !== 'http:') {
#       throw new Error('Blocked non-HTTP redirect scheme: ' + target.protocol);
#     }
#   }