Electron: HTTP redirect followed into local file loader

中 5.9CVE-2026-70605 · GHSA-v64r-4m7r-3mvq · 05/08/2026 公開 · 08/10/2026 更新

要点

CVE-2026-70605 は electron (electronjs), electron に影響する深刻度「中」 (CVSS 5.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.4% より高い）。
対処：40.9.0, 41.2.1, 39.8.8, 40.9.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
electron electronjs	`= 42.0.0≥ 40.0.0, < 40.9.0≥ 41.0.0, < 41.2.1< 39.8.8`	`40.9.041.2.139.8.8`
electron npm	`≥ 40.0.0-alpha.1, < 40.9.1≥ 41.0.0-alpha.1, < 41.2.1≥ 42.0.0-alpha.1, < 42.0.0-beta.3< 39.8.8`	`40.9.141.2.142.0.0-beta.339.8.8`

概要

Impact

When following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.

Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.

Workarounds

Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at [email protected]

NVD の説明

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.