https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 08 Aug 2026 00:33:44 +0000 https://vulnerability.circl.lu/sighting/004f2b3a-2437-4f29-83f3-c5f9359874e1/export {"uuid": "004f2b3a-2437-4f29-83f3-c5f9359874e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70607", "type": "seen", "source": "https://gist.github.com/alon710/9a7a5a858022e3c656feab4ec8f0d30d", "content": "# CVE-2026-70607: CVE-2026-70607: Privileged Option Injection in Electron window.open Features\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70607\n\n## Summary\nAn input validation vulnerability in the Electron desktop framework allows untrusted web content running in a renderer process to inject privileged configuration options when creating child windows via window.open. Under Windows environments, this allows attackers to pass a remote Universal Naming Convention (UNC) path to the window icon configuration parameter, forcing the host system to make an SMB connection to a remote listener and leak the current user's NetNTLM authentication hash.\n\n## TL;DR\nAn input validation vulnerability in Electron's window.open features parsing allows untrusted JavaScript to control privileged browser window options. This allows attackers to force UNC path loading, leaking Windows authentication hashes via SMB.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: Not Available\n- **Impact**: Information Disclosure (NetNTLM Hash Leak)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Electron Desktop Applications running on Windows\n- **electron**: < 39.8.8 (Fixed in: `39.8.8`)\n- **electron**: >= 40.0.0-alpha.1, < 40.9.0 (Fixed in: `40.9.0`)\n- **electron**: >= 41.0.0-alpha.1, < 41.2.1 (Fixed in: `41.2.1`)\n- **electron**: >= 42.0.0-alpha.1, < 42.0.0-beta.3 (Fixed in: `42.0.0-beta.3`)\n\n## Mitigation\n\n- Upgrade Electron to a patched version immediately.\n- Use setWindowOpenHandler to sanitize or reject client-side window options.\n- Apply strict Content Security Policies to block unauthorized JavaScript execution.\n\n**Remediation Steps:**\n1. Identify vulnerable Electron instances in package.json.\n2. Update Electron dependencies to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.\n3. Configure setWindowOpenHandler on the main process to validate and override client-supplied options.\n4. Validate that incoming requests cannot load remote UNC paths.\n\n## References\n\n- [GHSA-v93f-fgjr-hjrj Security Advisory](https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj)\n- [Fix Commit 30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a)\n- [CVE-2026-70607 Record](https://www.cve.org/CVERecord?id=CVE-2026-70607)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70607) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T17:33:01.781718Z"} {"uuid": "004f2b3a-2437-4f29-83f3-c5f9359874e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70607", "type": "seen", "source": "https://gist.github.com/alon710/9a7a5a858022e3c656feab4ec8f0d30d", "content": "# CVE-2026-70607: CVE-2026-70607: Privileged Option Injection in Electron window.open Features\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70607\n\n## Summary\nAn input validation vulnerability in the Electron desktop framework allows untrusted web content running in a renderer process to inject privileged configuration options when creating child windows via window.open. Under Windows environments, this allows attackers to pass a remote Universal Naming Convention (UNC) path to the window icon configuration parameter, forcing the host system to make an SMB connection to a remote listener and leak the current user's NetNTLM authentication hash.\n\n## TL;DR\nAn input validation vulnerability in Electron's window.open features parsing allows untrusted JavaScript to control privileged browser window options. This allows attackers to force UNC path loading, leaking Windows authentication hashes via SMB.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: Not Available\n- **Impact**: Information Disclosure (NetNTLM Hash Leak)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Electron Desktop Applications running on Windows\n- **electron**: < 39.8.8 (Fixed in: `39.8.8`)\n- **electron**: >= 40.0.0-alpha.1, < 40.9.0 (Fixed in: `40.9.0`)\n- **electron**: >= 41.0.0-alpha.1, < 41.2.1 (Fixed in: `41.2.1`)\n- **electron**: >= 42.0.0-alpha.1, < 42.0.0-beta.3 (Fixed in: `42.0.0-beta.3`)\n\n## Mitigation\n\n- Upgrade Electron to a patched version immediately.\n- Use setWindowOpenHandler to sanitize or reject client-side window options.\n- Apply strict Content Security Policies to block unauthorized JavaScript execution.\n\n**Remediation Steps:**\n1. Identify vulnerable Electron instances in package.json.\n2. Update Electron dependencies to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.\n3. Configure setWindowOpenHandler on the main process to validate and override client-supplied options.\n4. Validate that incoming requests cannot load remote UNC paths.\n\n## References\n\n- [GHSA-v93f-fgjr-hjrj Security Advisory](https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj)\n- [Fix Commit 30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a)\n- [CVE-2026-70607 Record](https://www.cve.org/CVERecord?id=CVE-2026-70607)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70607) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T17:33:01.781718Z"} https://vulnerability.circl.lu/sighting/004f2b3a-2437-4f29-83f3-c5f9359874e1/export Wed, 05 Aug 2026 17:33:01 +0000