CVE-2026-34768
LOW3.9EPSS 0.01%Electron: Unquoted executable path in app.setLoginItemSettings on Windows
描述
### Impact On Windows, `app.setLoginItemSettings({openAtLogin: true})` wrote the executable path to the `Run` registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. ### Workarounds Install the application to a path without spaces, or to a location where all ancestor directories are protected against unauthorized writes. ### Fixed Versions * `41.0.0-beta.8` * `40.8.0` * `39.8.1` * `38.8.6` ### For more information If there are any questions or comments about this advisory, send an email to [[email protected]](mailto:[email protected])
受影響套件(1)
- npm/electronfrom 0, < 38.8.6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.9 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L |