CVE-2026-70611

CVE-2026-70611 is a path traversal vulnerability in Electron's DevTools API that allows arbitrary native code execution outside the sandbox. The vulnerable function is `showItemInFolder`, a convenience API intended to open the file manager at a given path. When called from a compromised DevTools context — specifically via a malicious extension or untrusted content with DevTools access — it triggers native file manager operations directly, bypassing the Chromium sandbox entirely. The CVSS score of 6.9 reflects the 'separate means of running script' qualifier: you first need a pre-compromised DevTools context to reach this code. That qualifier is the only thing preventing this from scoring in the critical range. Once that boundary is crossed, the blast radius is total system compromise, not application-level impact. This is not a sandbox escape within Electron — it's a direct handoff to native OS operations that Electron's sandbox doesn't cover. Patched versions are 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3. The four-branch simultaneous fix indicates this function was implemented inconsistently across branches — likely as duplicated code rather than a shared internal API — which is why the patch spans all active versions. The deeper pattern worth knowing: this is the third documented Electron CVE following the same genetic sequence (CVE-2018-1000006 and CVE-2019-5842 also exploited DevTools-IPC boundaries). Each time, the postmortem noted that DevTools should be treated as semi-trusted input, but no structural remediation followed. The threat model acknowledges this boundary in documentation without enforcing it at the API level. For defenders: audit any Electron application that runs untrusted content or permits DevTools extensions. Check whether extensions are loaded from trusted sources only. The vulnerability manifests through a debugging convenience feature — it exists specifically to reduce developer friction, which is why it survived as long as it did.

Reviewed through automated stages and approved by a human before publication.