What is CVE-2026-70603?
In Electron framework, the shell.openPath() function does not properly reject paths containing embedded null bytes. This can lead to security bypasses in apps that perform only string-based path validation. Updating Electron to the latest version is recommended.
Azərbaycanca: Electron framework-də shell.openPath() funksiyası fayl yolunda gizli null baytları düzgün rədd etmir. Bu, yalnız sətir əsaslı yoxlama aparan tətbiqlərdə təhlükəsizlik yan keçidinə səbəb ola bilər. Electron-u ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ1
What is the bypass issue in Electron's shell.openPath() function?
The shell.openPath() function does not properly reject file paths containing embedded null bytes. This can lead to security bypasses in apps that perform only string-based path validation.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.