GitHub Advisoryadvisory · npm

GHSA-5rqw-r77c-jp79 Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

MEDIUM Published 2026-04-03 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-34779
Ecosystem
npm
Packages
electron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-78
Reviewed
2026-04-03

Affected packages

• npm electron: < 38.8.6 → fixed in 38.8.6 • npm electron: >= 39.0.0-alpha.1, < 39.8.1 → fixed in 39.8.1 • npm electron: >= 40.0.0-alpha.1, < 40.8.0 → fixed in 40.8.0 • npm electron: >= 41.0.0-alpha.1, < 41.0.0-beta.8 → fixed in 41.0.0-beta.8

Description

Impact On macOS, `app.moveToApplicationsFolder()` used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call `app.moveToApplicationsFolder()`. Apps that do not use this API are not affected. Workarounds There are no app side workarounds, developers must update to a patched version of Electron. Fixed Versions • `41.0.0-beta.8` • `40.8.0` • `39.8.1` • `38.8.6` For more information If there are any questions or comments about this advisory, please email [email protected]

Related

Alias · CVE (1)

  • CVE-2026-34779 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References